The CompTIA Cybersecurity Analyst (CySA+) course prepares students for the CS0-003 certification and focuses on incident detection, prevention, and response through continuous security monitoring. It covers improving security operations processes, differentiating between threat intelligence and threat hunting, analyzing malicious activity, implementing vulnerability assessments, prioritizing vulnerabilities, and making mitigation recommendations. The certification also includes updated attack methodology frameworks, incident response activities, incident management lifecycle, and communication best practices in vulnerability management and incident response.

The course includes the following high level objectives:

Security Operations

• Explain the importance of system and network architecture concepts in security operations.
• Given a scenario, analyse indicators of potentially malicious activity.
• Given a scenario, use appropriate tools or techniques to determine malicious activity.
• Compare and contrast threat-intelligence and threat-hunting concepts.
• Explain the importance of efficiency and process improvement in security operations.

Vulnerability Management

• Given a scenario, implement vulnerability scanning methods and concepts.
• Given a scenario, analyse output from vulnerability assessment tools.
• Given a scenario, analyse data to prioritize vulnerabilities.
• Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.
• Explain concepts related to vulnerability response, handling, and management.

Incident Response and Management

• Explain concepts related to attack methodology frameworks.
• Given a scenario, perform incident response activities.
• Explain the preparation and post-incident activity phases of the incident management life cycle.

Reporting and Communication

• Explain the importance of vulnerability management reporting and communication.
• Explain the importance of incident response reporting and communication.

The CompTIA Security+ course is tailored to prepare you for the SY0-701 exam. Students will acquire the necessary knowledge and skills to install and configure systems for securing applications, networks, and devices. They will also learn to perform threat analysis and respond with appropriate mitigation techniques, engage in risk mitigation activities, and operate with an understanding of relevant policies, laws, and regulations.

The high level objectives covered are:

General Security Concepts

• Compare and contrast various types of security controls.
• Summarize fundamental security concepts.
• Explain the importance of change management processes and the impact to security.
• Explain the importance of using appropriate cryptographic solutions.

Threats, Vulnerabilities, and Mitigations

• Compare and contrast common threat actors and motivations.
• Explain common threat vectors and attack surfaces.
• Explain various types of vulnerabilities.
• Given a scenario, analyze indicators of malicious activity.
• Explain the purpose of mitigation techniques used to secure the enterprise.

Security Architecture

• Compare and contrast security implications of different architecture models.
• Given a scenario, apply security principles to secure enterprise infrastructure.
• Compare and contrast concepts and strategies to protect data.
• Explain the importance of resilience and recovery in security architecture.

Security Operations

• Given a scenario, apply common security techniques to computing resources.
• Explain the security implications of proper hardware, software, and data asset management.
• Explain various activities associated with vulnerability management.
• Explain security alerting and monitoring concepts and tools.
• Given a scenario, modify enterprise capabilities to enhance security.
• Given a scenario, implement and maintain identity and access management.
• Explain the importance of automation and orchestration related to secure operations.
• Explain appropriate incident response activities.
• Given a scenario, use data sources to support an investigation.

Security Program Management and Oversight

• Summarize elements of effective security governance.
• Explain elements of the risk management process.
• Explain the processes associated with third-party risk assessment and management.
• Summarize elements of effective security compliance.
• Explain types and purposes of audits and assessments.
• Given a scenario, implement security awareness practices.