Use this cheat sheet for CompTIA CySA+ (CS0-003) after you know the security tools and need stronger analyst instincts. CySA+ questions reward evidence-based prioritization: correlate the signals, understand the asset, contain the threat, document the action, and improve the control.
Read every CySA+ question in this order
- Identify the analyst task: triage, hunting, vulnerability management, incident response, reporting, or tuning.
- Establish asset context: criticality, owner, exposure, identity, network segment, and data type.
- Correlate evidence across logs, endpoint signals, network traffic, identity, and vulnerability data.
- Choose the next safest action based on phase: investigate, contain, eradicate, recover, or report.
- Reject answers that skip evidence, destroy forensics, or patch by score alone.
CS0-003 answer sequence
Use this when the stem mixes alert evidence, asset context, vulnerability priority, or incident phase.
flowchart TD
S["Scenario"] --> A["Establish asset context"]
A --> E["Correlate evidence across sources"]
E --> P["Pick the next safest action"]
P --> R["Document, report, or improve the control"]
SOC triage map
| Alert clue |
First checks |
| impossible travel or suspicious login |
user history, MFA, geolocation, device, token activity, and recent password changes |
| malware or EDR hit |
process tree, hash, parent process, persistence, network connections, and scope |
| suspicious PowerShell or script |
encoded command, execution policy, parent process, command line, and target host |
| data exfiltration signal |
volume, destination, protocol, account, time, file type, and DLP context |
| web attack alert |
URL, payload, response code, WAF logs, server logs, and affected endpoint |
| privilege escalation |
group changes, token use, service account activity, and admin logons |
Log and evidence chooser
| Need |
Useful evidence |
| user activity |
authentication logs, IAM events, VPN logs, endpoint login history |
| host activity |
EDR telemetry, process logs, file changes, registry or persistence artifacts |
| network activity |
firewall, proxy, DNS, NetFlow, IDS/IPS, packet capture |
| cloud activity |
audit trail, control plane events, storage access, identity activity |
| email attack |
headers, URLs, attachments, sender reputation, mail gateway logs |
| timeline |
normalized timestamps, time zones, correlated event sequence |
Vulnerability prioritization
| Factor |
Why it changes priority |
| exploit available |
increases urgency beyond raw severity |
| internet exposure |
raises likelihood of exploitation |
| critical asset |
raises business impact |
| compensating control |
may reduce immediate risk but does not remove the finding |
| active exploitation |
moves from vulnerability management to incident response |
| patch complexity |
affects remediation plan, not whether risk exists |
| asset owner and SLA |
determines accountability and due date |
Incident response sequence
| Phase |
Exam instinct |
| preparation |
playbooks, tools, contacts, logging, training, and authority |
| detection and analysis |
validate alert, scope affected assets, preserve evidence, and classify severity |
| containment |
isolate host, disable account, block indicator, or segment traffic as appropriate |
| eradication |
remove malware, close vulnerability, revoke token, delete persistence |
| recovery |
restore service, monitor for recurrence, and validate clean state |
| lessons learned |
root cause, control gaps, metrics, owner, and prevention plan |
Threat hunting
| Hunting clue |
Better approach |
| hypothesis-driven hunt |
start with behavior, data source, query, and expected signal |
| indicator-based hunt |
search for hashes, domains, IPs, filenames, and known patterns |
| behavior-based hunt |
look for technique patterns such as lateral movement or unusual process chains |
| baseline anomaly |
compare against normal user, host, network, or application behavior |
| finding validated |
convert into detection logic, containment action, or control improvement |
Reporting and communication
| Audience |
What to include |
| SOC lead |
timeline, scope, confidence, containment, next action |
| system owner |
affected asset, risk, remediation, deadline, validation |
| executive |
business impact, exposure, recovery status, and residual risk |
| compliance or audit |
evidence, procedure followed, approvals, and control mapping |
| post-incident review |
root cause, what worked, what failed, and prevention actions |
Common traps
| Trap |
Better instinct |
| CVSS-only patch order |
combine exploitability, exposure, asset value, and active exploitation |
| wipe host first |
preserve needed evidence while stopping active harm |
| one log equals proof |
correlate across endpoint, identity, network, and time |
| alert fatigue response |
tune based on false positives and missed detections, not by disabling useful visibility |
| containment without scope |
understand spread before assuming one host is the whole incident |
| report as tool dump |
translate findings into risk, action, owner, and evidence |
Final 15-minute review
| If the stem says… |
Start here |
| alert triage |
asset context, correlated logs, timeline, and confidence |
| active compromise |
contain safely, preserve evidence, scope, eradicate, recover |
| vulnerability queue |
exploitability, exposure, criticality, compensating controls, SLA |
| suspicious identity activity |
authentication logs, MFA, token, privilege, device, geo |
| threat hunting |
hypothesis, data source, query, baseline, and validated finding |
| stakeholder update |
impact, status, next action, owner, and evidence |
Practice fit
Use IT Mastery for the exact product route, practice status, spaced review when available, and close-answer explanation practice as coverage expands.
One-line decision rule
CySA+ answers should correlate evidence before acting, prioritize by real risk, and close the loop with remediation and detection improvement.