CompTIA CySA+ (CS0-004) Exam Prep

What's inside

1. Level 1: Exam Briefing: CS0-004 Facts and Question StylesFree
   [Exam Briefing] The CS0-004 exam facts and how its questions work: up to 85 questions in 165 minutes, a pass mark of 750 on a 100-900 scale, the four domain weights (Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%), CS0-003 retiring on 22 December 2026, and the multiple-choice and performance-based question (PBQ) styles; it also explains that the objectives belong to CompTIA, are not reproduced here and can be downloaded free from CompTIA's site, that LevelUpWith is independent of CompTIA, and that passing is not promised.
2. Level 2: Logging Foundations: Ingestion, Time Sync, RetentionFree
   [Security Operations] How log ingestion, logging levels and configuration, log integrity and security, time synchronisation with Network Time Protocol (NTP), and log retention determine whether an analyst can trust and correlate events.
3. Level 3: Operating System Concepts for Analysts
   [Security Operations] Operating system (OS) concepts the exam tests: system hardening, file structures, critical files and the Windows Registry, configuration file locations, and normal versus abnormal processes and services on Windows and Linux.
4. Level 4: Infrastructure and Network Architecture
   [Security Operations] Architecture concepts covering on-premises, cloud-native, hybrid and serverless designs, virtualisation and containers, application programming interfaces (APIs), network segmentation, software-defined networking (SDN), zero trust and secure access service edge (SASE), and how each one changes where analysts get visibility.
5. Level 5: Identity and Access Management Concepts
   [Security Operations] Identity and access management (IAM) concepts: multifactor authentication (MFA), single sign-on (SSO), federation, privileged access management (PAM), passwordless authentication and cloud access security brokers (CASB), and how weaknesses in each show up in authentication logs.
6. Level 6: Encryption and Data Protection
   [Security Operations] Encryption and data protection concepts: public key infrastructure (PKI), Secure Sockets Layer/Transport Layer Security (SSL/TLS) inspection, data loss prevention (DLP), and handling personally identifiable information (PII) and cardholder data (CHD).
7. Level 7: Network Indicators of Malicious Activity
   [Security Operations] Network indicators of compromise (IoCs): bandwidth consumption, beaconing, irregular peer-to-peer traffic, rogue devices, scans and sweeps, unusual traffic spikes and activity on unexpected ports, read from firewall and flow log examples.
8. Level 8: Host-Based Indicators of Malicious Activity
   [Security Operations] Host-based indicators: abnormal CPU, memory and drive use, unauthorised software, malicious processes, unauthorised changes, privilege escalation, data exfiltration staging, Registry changes and unauthorised scheduled tasks, read from endpoint log examples.
9. Level 9: Application, Cloud and Identity-Based Indicators
   [Security Operations] Application, cloud and other indicators: anomalous application activity, unexpected new accounts, unexpected output, outbound communication, service interruption, cloud audit-log anomalies, and social engineering and identity-based threats such as obfuscated links and MFA fatigue.
10. Level 10: SIEM Correlation and Queries
    [Security Operations] Using a security information and event management (SIEM) system: normalisation, correlation rules, dashboards and writing search queries to pivot across log sources during an investigation.
11. Level 11: EDR and XDR Telemetry Analysis
    [Security Operations] Using endpoint detection and response (EDR) and extended detection and response (XDR) telemetry: process trees, command-line arguments, file and network events, and host isolation, to investigate suspicious endpoint behaviour.
12. Level 12: Packet Capture with Wireshark and tcpdump
    [Security Operations] Packet capture and analysis with Wireshark and tcpdump: capture filters versus display filters, following streams, and finding malicious payloads, DNS (Domain Name System) tunnelling and cleartext credentials in packet capture (PCAP) files.
13. Level 13: Reputation Lookups, File Analysis and Sandboxing
    [Security Operations] Analysis tools and techniques: IP and domain reputation, WHOIS, VirusTotal, file hashing, string analysis, YARA rules and detonating samples in a sandbox to see how they behave.
14. Level 14: Data Formats and Scripting for Analysts
    [Security Operations] Reading and automating with the data formats and scripting the exam tests: JSON (JavaScript Object Notation), XML (Extensible Markup Language), regular expressions, and short Python, PowerShell and shell scripts used to parse logs and IoCs.
15. Level 15: Threat Actors and Threat Intelligence Sources
    [Security Operations] Threat actors, including advanced persistent threats (APTs), nation-states, organised crime, hacktivists, insiders and supply chain threats, and threat intelligence sources and sharing: open-source intelligence (OSINT), Information Sharing and Analysis Centers (ISACs), threat intelligence platforms (TIPs), Structured Threat Information eXpression (STIX) and Trusted Automated eXchange of Intelligence Information (TAXII), confidence levels and intelligence types.
16. Level 16: Threat Hunting with ATT&CK and the Pyramid of Pain
    [Security Operations] Hypothesis-driven threat hunting: building hunt hypotheses from intelligence, mapping TTPs to MITRE ATT&CK, using the Pyramid of Pain and attribution concepts, choosing where to hunt, and turning IoC analysis into new detections.
17. Level 17: Process Improvement, SOAR and Automation
    [Security Operations] Improving SOC (security operations centre) efficiency: standardised playbooks and runbooks, security orchestration, automation and response (SOAR), infrastructure as code (IaC) hooks, data enrichment, alert and rule tuning, and deciding what to automate and what needs a human.
18. Level 18: Responsible Use of AI in Security Operations
    [Security Operations] Using artificial intelligence (AI) responsibly in the SOC: risk governance, data-handling and accuracy risks, and use cases such as log analysis, comparing artefacts and summarising findings with an analyst checking the output.
19. Level 19: Asset Discovery and Vulnerability Scanning Methods
    [Vulnerability Management] Asset discovery and inventory, and the vulnerability scanning approaches the exam contrasts: internal versus external, agent-based versus agentless, credentialed versus non-credentialed, and passive versus active, plus special considerations for operational technology (OT) and industrial control systems (ICS).
20. Level 20: Scan Configuration, Scheduling and Tool Families
    [Vulnerability Management] Configuring vulnerability scans: scope, schedules, sensitivity levels, segmentation and regulatory requirements, and choosing between network scanners such as Nmap, Nessus and OpenVAS, web application scanners such as Burp Suite, OWASP ZAP and Nikto, and cloud configuration assessment tools.
21. Level 21: Configuring Vulnerability Scans Safely
    [Vulnerability Management] Learn to set up a vulnerability scan: scheduling, scope and segmentation, sensitivity levels and plugin selection, regulatory requirements such as PCI DSS (Payment Card Industry Data Security Standard), and limiting the load scans put on production systems.
22. Level 22: Scanning Cloud, Containers, OT, IoT and Mobile
    [Vulnerability Management] Learn the special cases in scanning: OT (operational technology), ICS (industrial control systems) and SCADA (supervisory control and data acquisition), IoT (Internet of Things), mobile devices, cloud workloads, container images and IaC (infrastructure as code) templates.
23. Level 23: Application Security Testing: SAST, DAST, IAST, SCA
    [Vulnerability Management] Compare the ways to test applications: SAST (static application security testing), DAST (dynamic application security testing), IAST (interactive application security testing), SCA (software composition analysis) with an SBOM (software bill of materials), fuzzing and reverse engineering, and see where each fits in a CI/CD (continuous integration/continuous delivery) pipeline.
24. Level 24: Reading Vulnerability Scanner Reports
    [Vulnerability Management] Read output from network vulnerability scanners such as Nessus, OpenVAS and Qualys: plugin IDs, CVE (Common Vulnerabilities and Exposures) and CWE (Common Weakness Enumeration) references, severity, and evidence. Then sort each finding into true or false positive or negative.
25. Level 25: Network and Web App Tool Output
    [Vulnerability Management] Read output from the assessment tools CompTIA names, including Nmap port and service scans, Nikto, OWASP (Open Worldwide Application Security Project) ZAP, Burp Suite, and Metasploit module results, and draw findings from each.
26. Level 26: Cloud and Configuration Assessment Output
    [Vulnerability Management] Read cloud and configuration assessment output, for example from Prowler, ScoutSuite and Pacu, and compare it with CIS (Center for Internet Security) benchmarks. Learn to spot misconfigurations such as public storage, too-broad IAM (identity and access management) policies and open security groups.
27. Level 27: Decoding CVSS Vectors
    [Vulnerability Management] Learn to read CVSS (Common Vulnerability Scoring System) base metric vectors, metric by metric: attack vector, attack complexity, privileges required, user interaction, scope or impact on subsequent systems, and confidentiality, integrity and availability. Then work out how serious a vector string makes a vulnerability.
28. Level 28: Prioritising with Context, Not Just Scores
    [Vulnerability Management] Prioritise vulnerabilities using context as well as the score: asset value and criticality, exposure, whether an exploit exists or is weaponised, the CISA (Cybersecurity and Infrastructure Security Agency) KEV (Known Exploited Vulnerabilities) catalog, EPSS (Exploit Prediction Scoring System), zero-days and compensating controls already in place.
29. Level 29: Common Vulnerabilities and Their Mitigations
    [Vulnerability Management] Match the vulnerability types CompTIA lists to their fixes and to secure coding practice: injection, XSS (cross-site scripting), CSRF (cross-site request forgery), SSRF (server-side request forgery), buffer overflow, broken access control, cryptographic failures, insecure design, data poisoning and identification/authentication failures.
30. Level 30: Controls, Patching and Remediation Inhibitors
    [Vulnerability Management] Choose how to treat a vulnerability: control types (managerial, operational, technical; preventive, detective, corrective, compensating), patch and configuration management, maintenance windows, exceptions, and risk acceptance or transfer. Learn what blocks remediation, such as legacy systems, SLAs (service-level agreements), MOUs (memorandums of understanding) and business process interruption.
31. Level 31: Attack Surface Management and Validation
    [Vulnerability Management] Learn attack surface management and how to check that fixes worked: edge and passive discovery, external asset inventory, penetration testing, bug bounty programmes, red, blue and purple teaming, security controls testing and rescanning.
32. Level 32: Attack Methodology Frameworks
    [Incident Response and Management] Apply the attack methodology frameworks: Lockheed Martin Cyber Kill Chain, Diamond Model of Intrusion Analysis, MITRE ATT&CK (Adversarial Tactics, Techniques and Common Knowledge), Unified Kill Chain, OSSTMM (Open Source Security Testing Methodology Manual) and the OWASP Testing Guide.
33. Level 33: IR Lifecycle and Preparation
    [Incident Response and Management] Learn the incident response lifecycle in NIST (National Institute of Standards and Technology) SP 800-61 and get ready for incidents: the IR (incident response) plan, playbooks, tools, roles, training, tabletop exercises, and alignment with BC (business continuity) and DR (disaster recovery).
34. Level 34: Detection, Analysis and Severity Triage
    [Incident Response and Management] Confirm and triage an incident: check IoCs (indicators of compromise), work out the scope and the systems affected, judge impact, and assign severity and priority so the right escalation path starts.
35. Level 35: Evidence Acquisition and Order of Volatility
    [Incident Response and Management] Collect evidence in the order of volatility: memory capture, disk imaging (bit-for-bit copies with tools such as dd and FTK Imager), log collection, cloud and virtual machine snapshots, and timeline building.
36. Level 36: Chain of Custody and Legal Preservation
    [Incident Response and Management] Handle evidence so it holds up in court: chain of custody records, integrity checks with hashes such as SHA-256 (Secure Hash Algorithm 256-bit), write blockers, legal hold, preservation and secure storage.
37. Level 37: Containment Strategies
    [Incident Response and Management] Choose a containment strategy: isolating a host, network segmentation, disabling accounts, blocking IPs (Internet Protocol addresses) and domains, and removing systems. Weigh evidence preservation and business impact, and decide when to watch the attacker rather than stop them at once.
38. Level 38: Eradication and Recovery
    [Incident Response and Management] Remove the threat and restore service: reimage versus clean, sanitisation, patching, credential resets, restoring from known-good backups, adding compensating controls, and monitoring to confirm recovery.
39. Level 39: Analysing Forensic Artefacts
    [Incident Response and Management] Read forensic artefacts found during an investigation: memory analysis with Volatility (process lists, network connections, injected code), disk analysis with Autopsy, persistence mechanisms, and file hash checks.
40. Level 40: Post-Incident Activity and Lessons Learned
    [Incident Response and Management] Finish an incident properly: run a lessons-learned review, write the after-action report, update the IR plan, playbooks and detection rules, apply evidence retention policy, and feed what was learned back into preparation.
41. Level 41: Review: Evidence Handling End to End
    [Incident Response and Management] Learn to collect, preserve and document digital evidence so it holds up later: order of volatility, forensic imaging, hash checks, legal hold and an unbroken chain of custody.
42. Level 42: Review: Closing an Incident Well
    [Incident Response and Management] Learn how the post-incident phase feeds improvements back into readiness: lessons-learned meetings, updated playbooks and detections, evidence retention and changes to controls.
43. Level 43: Incident Lifecycle Drill: Multi-Stage Scenario
    [Incident Response and Management] Work a whole multi-stage intrusion from first alert to closure in performance-based style, choosing the right lifecycle action at each step from logs, EDR alerts and network evidence.
44. Level 44: Vulnerability Management Reporting
    [Reporting and Communication] Learn what a vulnerability management report contains: vulnerabilities, affected hosts, risk scores, mitigations, recurrence and prioritisation, and how to build one from scanner output.
45. Level 45: Compliance Reports and Action Plans
    [Reporting and Communication] Learn to write compliance reporting and remediation action plans that cover configuration management, patching, compensating controls, awareness training and business requirements.
46. Level 46: Inhibitors to Remediation
    [Reporting and Communication] Learn the inhibitors to remediation the exam names (MOU, SLA, organisational governance, business process interruption, degrading functionality, legacy and proprietary systems) and how to report risk you cannot remediate.
47. Level 47: Vulnerability Metrics and KPIs
    [Reporting and Communication] Learn the metrics and KPIs used to measure a vulnerability programme: trends, top-ten lists, critical vulnerabilities and zero-days, SLOs and remediation times.
48. Level 48: Vulnerability Stakeholders and Communication
    [Reporting and Communication] Learn to tailor vulnerability communication to each stakeholder (executives, system owners, engineers, auditors) and to escalate findings that are overdue or critical.
49. Level 49: Incident Declaration, Escalation and Comms
    [Reporting and Communication] Learn how incidents are declared and escalated, and how communication with legal, public relations, customers, media, regulators and law enforcement is handled.
50. Level 50: Incident Reports, Root Cause and IR Metrics
    [Reporting and Communication] Learn to write an incident response report (executive summary, timeline, scope, impact, evidence, recommendations), carry out root cause analysis and measure response with MTTD, MTTR and alert volume.
51. Level 51: Acronym Review and Performance-Based Practice
    [All sections] Review every CS0-004 acronym not yet taught, with its full form and meaning, and practise each performance-based question style across all four domains.
52. Level 52: Named Tools: Sandboxes, Recon, Scanners and Attack Simulation
    [Objectives 1.3 and 2.2] Teaches the tools CompTIA's CS0-004 objectives name by example that no earlier level covers, so the learner recognises each one in a scenario, in tool output or among the wrong answers.
53. Level 53: Remaining Concepts and Acronyms: ISO 27000, Inherent Risk and More
    [Objectives 1.2, 2.1, 2.4; Acronym list] Teaches the remaining CS0-004 concepts and reviews the acronyms on CompTIA's list that no earlier level spells out.
54. Level 54: Timed Mock Exam (85 Questions, 165 Minutes) Timed mock
    A timed 85-question, 165-minute mock exam that tests all four CS0-004 domains in proportion to their weights, with original scenario and performance-style questions and an 80% pass mark.

Access

The first 2 levels are free with a free account. Every level, the podcast edition and the AI tutor come with All Access at £4.99/month or any Creator plan — see pricing.

Start free →