Cyber Sentinel Review Guide Cyber Sentinel
Comprehensive CySA+ Review Guide (CS0-003)
Exam Domains
1.0 Threat and Vulnerability Management
2.0 Software and Systems Security
3.0 Security Operations and Monitoring
4.0 Incident Response
5.0 Compliance and Assessment
Guide Focus
This document provides a deep dive into the technical skills required for cybersecurity analysts. It focuses on threat detection, analysis, and response using modern security tools and frameworks.
CompTIA CySA+ (CS0-003)
Study Material 01
Classified: Internal Training Only
v1.0.2026
1.0 Threat and Vulnerability Management
24% of Exam
Threat Intelligence & Analysis
Strategic
High-level trends, threat actors, and business impact for executives.
Tactical
Immediate TTPs (Tactics, Techniques, and Procedures) used by actors.
Operational
Actionable IOCs (IPs, hashes, URLs) for automated blocking/alerting.
The Intelligence Cycle
Requirements Collection Processing Analysis Dissemination
Vulnerability Management Process
Phase Key Activities Identification Asset inventory, vulnerability scanning (Nessus, OpenVAS). Prioritization Risk ranking based on asset value and CVSS scores. Remediation Patching, configuration changes, or decommissioning. Verification Rescanning to confirm fix effectiveness.
CVSS v3.1 Scoring
Base Score: Inherent qualities (AV, AC, PR, UI, S, C, I, A).
Temporal: Factors that change over time (Exploitability).
Environmental: Custom to user environment.
Severity: 9.0-10.0 (Critical), 7.0-8.9 (High).
2.0 Software and Systems Security
18% of Exam
Infrastructure Security & Cloud
Segmentation
VLANs, Micro-segmentation, Air-gapping, and Jump servers to limit lateral movement.
Cloud Shared Responsibility
• SaaS: Provider manages almost everything.
• PaaS: Customer manages apps/data.
• IaaS: Customer manages OS, apps, network config.
Analyst Pro Tip: Web Vulns
XSS: Client-side injection. Use input sanitization.SQLi: Database injection. Use parameterized queries.SSRF: Forcing server to make requests. Use allowlists.CSRF: Forced unintended actions. Use anti-CSRF tokens.
Secure Software Development (DevSecOps)
Analysis
SAST
White-box, Static code
Analysis
DAST
Black-box, Runtime
Review
Manual
Peer review, Logic
Supply Chain
SCA
Libraries & Dependencies
3.0 Security Operations and Monitoring
28% of Exam
Monitoring & Detection
SIEM
Log Aggregation & Correlation
Splunk, ELK, Sentinel
SOAR
Orchestration & Automation
Playbooks, Runbooks
EDR
Endpoint Detection & Response
CrowdStrike, Carbon Black
Continuous Monitoring Workflow
1. Data Ingestion (Logs, NetFlow, API)
2. Normalization & Enrichment
3. Correlation & Alert Generation
4. Triage & Investigation
Threat Hunting Methodologies
Hypothesis-Driven
Proactive searching based on a likely attack scenario or actor profile.
Intel-Based
Driven by new IOCs (hashes, IPs) or reports from TI feeds.
Analytics-Based
Looking for outliers in baseline behavior (UEBA, unusual traffic volume).
4.0 Incident Response
18% of Exam
Incident Response Lifecycle (NIST)
1
Preparation
Tools, training, policy
2
Detection & Analysis
SIEM, Triage, Scope
3
Containment
Isolation, Quarantining
4
Eradication & Recovery
Malware removal, Restore
5
Post-Incident
Lessons Learned
Forensic Data Acquisition
Order of Volatility
CPU Cache, Registers
RAM (Physical Memory)
Network State / Temporary Files
Disk (HDD/SSD)
Archival / Remote Logs
Chain of Custody
Documentation of every person who handled evidence, the date/time, and the location to ensure legal admissibility.
Containment Strategies
Isolation
Moving a device to a restricted VLAN with no internet access.
Segmentation
Cutting off a compromised network branch from the core.
Removal
Physically disconnecting the host from the network.
Decision: Contain vs Watch
Contain immediately if the threat is high-impact. Watch (Sandboxing) to gather intel on low-impact threats.
5.0 Compliance and Assessment
12% of Exam
Frameworks & Control Categories
Regulatory Frameworks
GDPR: Privacy of EU citizen data.HIPAA: Protection of healthcare info (PHI).PCI-DSS: Security for credit card processing.SOX: Financial reporting accuracy.
Industry Standards
NIST CSF: Identify, Protect, Detect, Respond, Recover.ISO/IEC 27001: Information security management.CIS Controls: Prioritized set of 18 actions.
Risk Assessment Concepts
Calculation
SLE x ARO = ALE
Single Loss Expectancy x Annual Rate of Occurrence = Annual Loss Expectancy
Risk Treatment
Transfer
Insurance or outsourcing the liability to a third party.
Risk Treatment
Mitigation
Implementing security controls to reduce the risk level.
Final Analyst Readiness
I can interpret Nessus and OpenVAS scan reports.
I can read and analyze PCAP files in Wireshark.
I understand the difference between False Positives and Negatives.
I know when to isolate a host vs. continue monitoring.
I understand CVSS vector strings (e.g., AV:N/AC:L/PR:N/UI:N).
I can differentiate between SOAR playbooks and manual IR plans.
Cyber Sentinel Cheat Sheet Cyber Sentinel
CySA+ CS0-003 Cheat Sheet
Quick Ref
02-A
Essential Nmap Flags
-sS SYN Stealth
-sV Service Version
-O OS Detection
-A Aggressive
-p- All Ports
-T4 Speed (Aggressive)
-Pn No Ping
Common Analyst Ports
22 SSH
53 DNS
389 LDAP
443 HTTPS
445 SMB
636 LDAPS
3389 RDP
514 Syslog
8080 Proxy
9200 ELK
Linux Command Line
grep -r "pattern" /pathtail -f /var/log/sysloglsof -i :80journalctl -u ssh
CVSS v3.1 Metrics
Attack Vector (AV)
N: Network | A: Adjacent
Attack Complexity (AC)
L: Low | H: High
Privileges Required (PR)
N: None | L: Low | H: High
User Interaction (UI)
N: None | R: Required
CIA Impact (C, I, A)
N: None | L: Low | H: High
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)
Windows Forensics
Registry
Run/RunOnce (Persistence), ShimCache (Exec history).
Event Logs
4624 (Logon), 4625 (Failed), 4688 (Process Start).
Prefetch
Evidence of application execution, timestamps.
PowerShell
Script Block Logging (4104) - reveals obfuscated scripts.
Scanners
• Nessus (Network)
• Nikto (Web)
• OpenVAS (Open Source)
• Qualys (Enterprise)
Analysis
• Wireshark (PCAP)
• Zeek (NetFlow)
• Volatility (RAM)
• Autopsy (Disk)
The Diamond Model
ADVERSARY
INFRA
CAPABILITY
VICTIM
Relates attacker motivation to technical capabilities.
Log Severity
0: Emergency
1: Alert
2: Critical
Cyber Sentinel Practice Scenarios Practice Scenarios
CySA+ (CS0-003) Assessment
Document ID
CS-PRAC-03
Analyst Name
Date
Section 1: Knowledge Verification
1. A security analyst is reviewing a CVSS v3.1 vector string: AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N. Which of the following is the MOST accurate interpretation of this vulnerability?
It is accessible from the local network and requires no user interaction.
It requires high privileges and can be exploited over the internet.
It has a high impact on availability and requires physical access.
It involves a scope change and high attack complexity.
2. During a threat hunting exercise, an analyst notices a large volume of DNS traffic going to a domain that was registered yesterday. The traffic pattern shows small packets sent at regular 5-minute intervals. What is the MOST likely activity?
A legitimate automated software update from a new CDN.
Beaconing from a compromised host to a Command and Control (C2) server.
A distributed denial-of-service (DDoS) attack targeting the DNS server.
An internal user performing a recursive zone transfer.
Section 2: Forensic Log Analysis
SIEM ALERT: UNUSUAL_AUTH_ACTIVITY
Mar 06 14:02:11 web-prod-01 sshd[12402]: Failed password for invalid user admin from 192.168.1.45 port 54220 ssh2
Mar 06 14:02:14 web-prod-01 sshd[12405]: Failed password for invalid user root from 192.168.1.45 port 54224 ssh2
Mar 06 14:02:18 web-prod-01 sshd[12408]: Failed password for invalid user manager from 192.168.1.45 port 54228 ssh2
Mar 06 14:02:22 web-prod-01 sshd[12412]: Failed password for user jdoe from 192.168.1.45 port 54232 ssh2
Mar 06 14:03:01 web-prod-01 sshd[12450]: Accepted password for user jdoe from 192.168.1.45 port 54250 ssh2
Mar 06 14:03:05 web-prod-01 sshd[12455]: pam_unix(sshd:session): session opened for user jdoe by (uid=0)
Mar 06 14:03:10 web-prod-01 sudo: jdoe : TTY=pts/0 ; PWD=/home/jdoe ; USER=root ; COMMAND=/usr/bin/apt-get update
3. Analyze the log provided above. Describe the sequence of events and identify the point of compromise.
4. Based on your analysis, what are the next TWO immediate containment steps the analyst should take?
STEP 1
STEP 2
Section 3: Incident Response Matrix
Scenario: The Ransomware Scare
An EDR alert triggers on a marketing executive's laptop, detecting a process attempting to modify multiple files in the C:\Users\Documents folder with the extension .crypt. The laptop is currently connected to the corporate HQ Wi-Fi. Your organization follows the NIST SP 800-61 Rev 2 lifecycle.
Cyber Sentinel Answer Key Answer Key & Explanations
Cyber Sentinel Analyst Guide
Section 1: Knowledge Verification
1. Correct Answer: Option 2 (It requires high privileges and can be exploited over the internet.)
Explanation: The vector string AV:N indicates "Network" (internet accessible), while PR:H indicates "Privileges Required: High". Other metrics: AC:L (Low complexity), UI:N (No user interaction), S:U (Scope unchanged), C:L/I:L/A:N (Low impact on Confidentiality/Integrity, None on Availability).
2. Correct Answer: Option 2 (Beaconing from a compromised host to a C2 server.)
Explanation: Frequent, regular intervals (heartbeats) and the use of a newly registered domain are classic indicators of command and control beaconing. Legitimate updates are rarely that predictable at 5-minute intervals across a long duration.
Section 2: Forensic Log Analysis
3. Sequence of Events & Point of Compromise
Analysis: The logs show a Brute Force / Password Spray attack originating from 192.168.1.45. The attacker first attempts invalid usernames (admin, root, manager) before targeting a valid user jdoe.
Point of Compromise: 14:03:01. This is when the "Accepted password" log entry appears. Following this, the attacker successfully gains a session and immediately uses sudo to attempt system updates/escalation.
4. Immediate Containment Steps
Disable/Reset jdoe Account: Immediately lock the compromised account to prevent further access.Isolate the Host: Move web-prod-01 to a quarantined VLAN or disconnect it to prevent lateral movement, as the attacker has already gained sudo access.Identify Source: Investigate host 192.168.1.45 as it is the internal source of the attack.
Section 3: Incident Response Matrix
A. Phase Identification
Detection and Analysis
Reviewing EDR alerts to validate a threat is the core of this phase.
B. Containment Strategy
Isolation (VLAN / Network)
Disconnecting the host or moving it to a sandbox VLAN.
Response Justification
Isolation is preferred over powering off the machine because powering off destroys volatile evidence (RAM data) which is crucial for identifying the ransomware strain and the initial infection vector. Isolation stops the encryption process from spreading to network shares (SMB) while allowing the analyst to perform live forensics or take a memory image.
Section 4: Threat Intelligence
