What type of threat intelligence focuses on the tactics, techniques, and procedures (TTPs) used by threat actors?
Cysa Security Operations
Question · Easy
Dad clicked the link: the malware removal order
Short
CySA+ CS0-003 in 30 Days: Study Plan for SOC Analysts (2026)
Pass CySA+ CS0-003 in 30 days. Week-by-week plan, PBQ practice workflow, SIEM drills, and domain-weighted strategy built for working SOC analysts. Updated 2026.
Blog
SIEM (Security Information and Event Management)
Security Operations
Flashcard
Which SIEM component is responsible for collecting and normalizing log data from various sources?
Clock-synchronization protocol operating over UDP port 123 that organizes time servers into numbered stratum hierarchy levels from 1 to 15 so distributed hosts record consistent log timestamps.
Guess the Term
Chapter 1: CompTIA CySA+ Orientation and Exam Strategy
1.1 Current CompTIA CySA+ Exam Facts
Study guide
Cheat sheet
What is the primary purpose of an IOC (Indicator of Compromise)?
Read the clue and guess the term in 6 tries.
Game
Log collector vs correlation engine (SIEM components)
Which log format is commonly used for network device logging and follows a standardized structure?
Centralized event-messaging standard defined in RFC 5424 that calculates each message priority value by multiplying a facility code from 0 to 23 by 8 and adding a severity code from 0 to 7.
What is threat hunting?
AWS or YOU?
Syslog
A security analyst notices multiple failed login attempts from various IP addresses targeting a single user account, followed by a successful login from an unusual location. Which type of attack is most likely occurring?
Question · Medium
Access-control model in CompTIA CS0-003 Objective 1.1 that replaces implicit perimeter network trust with per-request verification enforced through a policy engine, policy administrator, and policy enforcement point.
1.2 Eligibility, Application, and Scheduling
Which MITRE ATT&CK tactic represents the initial phase where an adversary tries to gain entry into the network?
Swap tiles to line up three of the same term.
Term Match
True positive vs false positive vs false negative
An analyst is investigating network traffic and notices DNS queries to domains with high entropy names like "x8j2k9m3p.cloud-domain.net." What should the analyst suspect?
Policy enforcement intermediary positioned between enterprise users and external cloud providers to discover unsanctioned shadow applications, regulate data sharing, and enforce encryption and access rules across SaaS platforms.
Which Windows Event Log ID would be most relevant for tracking successful user logins?
Tuning a detection rule
What is the primary benefit of using SOAR (Security Orchestration, Automation and Response) platforms?
XML-based federation standard standardized by OASIS that enables web single sign-on by passing digitally signed authentication, attribute, and authorization decision statements from an identity provider to a relying service provider.
1.3 Blueprint Domains and Weighting
During memory analysis, an analyst discovers a process running with the same name as a legitimate Windows process but from an unusual directory. What technique is likely being used?
Flip two cards at a time to find matching terms.
Term Pairs
Behavioral analytics / UEBA
An organization seeds its file shares and directories with fake credentials and documents that trigger an alert the moment any of them is accessed. What is the specific name for these individual decoy artifacts?
Sensitive-information safeguard in CompTIA CS0-003 Objective 1.1 that inspects data at rest, in motion, and in use to detect and block unauthorized exfiltration of cardholder records or personally identifiable information.
Which cloud monitoring approach provides visibility into API calls and user activities across cloud resources?
SOAR (Security Orchestration, Automation, and Response)
What type of analysis involves examining network traffic to identify anomalous patterns that may indicate data exfiltration?
Periodic outbound heartbeat signal transmitted at regular or jittered intervals from a compromised internal host to an external command-and-control server to report status or poll for attacker instructions.
1.4 Question Style and Score Report Thinking
An analyst discovers PowerShell executing encoded commands that download and execute a payload from a remote server. The payload then injects code into a legitimate explorer.exe process. Which combination of MITRE ATT&CK techniques is being demonstrated?
Question · Hard
Find five hidden terms in a grid of letters.
Term Search
XDR (Extended Detection and Response)
A security team is investigating an alert showing unusual outbound HTTPS connections from a server. The connections occur at regular intervals, transfer consistent data volumes, and use domains registered recently. Memory analysis shows no unusual processes, but a scheduled task references a PowerShell script. What is the most likely conclusion?
Centralized security operations platform that ingests, normalizes, and correlates event logs from heterogeneous hosts, network appliances, and applications to detect multi-stage attack patterns and generate prioritized analyst alerts.
An XDR platform correlates alerts from multiple sources: an EDR alert about LSASS access, a network alert about SMB traffic to an unusual file server, and an identity alert about impossible travel. Which attack chain is most likely occurring?
Loading more…