The course prepares professionals to identify malicious activity, assess security risks, and effectively communicate findings to various stakeholders within the organization.
Training Objectives
Upon completion of this course, you will be able to:
- Understand the fundamental principles of security operations and systems and network architecture.
- Analyze indicators of potentially malicious activity in networks, systems, and applications.
- Use threat intelligence and threat hunting tools and techniques.
- Implement efficient vulnerability management and assessment processes.
- Interpret and prioritize results obtained through vulnerability analysis tools.
- Recommend controls and mitigation measures against software threats and vulnerabilities.
- Manage patching processes, vulnerability response, and reduction of attack surfaces.
- Apply recognized methodologies for security incident analysis and response.
- Prepare vulnerability reports and security metrics oriented toward decision-making.
- Effectively communicate incidents, risks, and corrective actions to stakeholders.
CompTIA CySA+ (CS0-003) Course Content
Module 1. Security Operations
- Systems and network architecture concepts applied to security.
- Log ingestion and analysis.
- Operating systems and infrastructures.
- Network architecture.
- Identity and access management.
- Encryption and sensitive data protection.
- Identification of indicators of malicious activity.
- Network, host, and application activity.
- Social engineering and obfuscated links.
Module 2. Threat Hunting Concepts and Tools
- Tools for detecting malicious activity.
- Common analysis techniques.
- Programming and scripting languages.
- Threat intelligence.
- Threat actors.
- Tactics, techniques, and procedures (TTPs).
- Confidence levels.
- Collection methods and sources.
- Threat hunting processes.
Module 3. Process Improvement and Vulnerability Management
- Standardization and optimization of security processes.
- Integration of tools and technologies.
- Centralized operations visibility.
- Asset discovery.
- Vulnerability scanning methods.
- Internal and external scans.
- Authenticated and unauthenticated scans.
- Passive and active analysis.
- Static and dynamic scanning.
- Critical infrastructures.
- Security baselines.
- Industry frameworks.
Module 4. Data and Vulnerability Prioritization
- Vulnerability assessment tools.
- Network scanning and mapping.
- Web application scanners.
- Vulnerability scanners.
- Multipurpose tools.
- Cloud infrastructure assessment.
- Interpretation of CVSS metrics.
- Risk validation and contextualization.
- Exploitability and weaponization.
- Asset value.
- Zero-day vulnerabilities.
Module 5. Mitigation Techniques
- Mitigation controls for vulnerabilities and attacks.
- Cross-Site Scripting (XSS).
- Buffer overflow vulnerabilities.
- Data Poisoning.
- Insecure access control.
- Cryptographic failures.
- Injection vulnerabilities.
- Cross-Site Request Forgery (CSRF).
- Directory Traversal.
- Insecure design.
- Incorrect configurations.
- Obsolete or unsupported components.
- Authentication and identification failures.
- Server-Side Request Forgery (SSRF).
- Remote code execution.
- Privilege escalation.
- Local and remote file inclusion (LFI/RFI).
Module 6. Patch Management and Data Protection
- Vulnerability response and management.
- Compensating controls.
- Types of controls.
- Patch and configuration management.
- Exception management.
- Risk management principles.
- Security policies and governance.
- Service Level Objectives (SLOs).
- Prioritization and escalation.
- Attack surface management.
- Secure development best practices.
- Secure Software Development Life Cycle (SDLC).
- Threat modeling.
Module 7. Attack Methodologies and Incident Response
- Cyber Kill Chain.
- Diamond Model of Intrusion Analysis.
- MITRE ATT&CK.
- OSSTMM.
- OWASP Testing Guide.
- Incident detection and analysis.
- Containment, eradication, and recovery.
- Incident preparedness.
- Post-incident activities.
Module 8. Reporting
- Vulnerability report management.
- Regulatory compliance reports.
- Action plans.
- Key Performance Indicators (KPIs).
- Stakeholder identification and communication.
Module 9. Cybersecurity Communication
- Stakeholder identification.
- Incident communication and escalation.
- Incident response reporting.
- Internal and external communication.
- Root cause analysis.
- Lessons learned.
- Security metrics and indicators.
CompTIA CySA+ Lab
This hands-on lab provides real-world experience in core areas of cybersecurity operations, focusing on the implementation of security controls, detection of malicious activities, vulnerability management, and incident response.
Throughout the practical exercises, participants will develop skills using widely employed industry tools and techniques to perform tasks such as:
- Log analysis and correlation.
- Implementation of encryption and multi-factor authentication (MFA) mechanisms.
- Network traffic analysis and threat identification.
- Vulnerability scanning and assessment.
- Patch management and security configurations.
- Digital forensics and investigation.
- Detection, containment, and response to security incidents.
The labs are aligned with the official CompTIA CySA+ (CS0-003) exam objectives and cover the primary knowledge areas related to Security Operations, Vulnerability Management, Incident Response and Management, as well as Reporting and Communication.
Upon completion of the labs, participants will be prepared to identify threats, assess risks, maintain more secure IT environments, and respond effectively to cybersecurity incidents in enterprise environments.
Prerequisites
It is recommended that participants have basic knowledge of networks, operating systems, and fundamental cybersecurity concepts. Additionally, previous experience in systems administration, technical support, or information security is beneficial.
Although not mandatory, it is recommended to have acquired knowledge equivalent to CompTIA Security+ or practical experience in security environments.
Language
- Course: English
- Labs: English
Frequently Asked Questions about CompTIA CySA+ (CS0-003)
What is the CompTIA CySA+ certification?
CompTIA CySA+ (Cybersecurity Analyst) is an international certification that validates the skills required to detect threats, analyze security events, manage vulnerabilities, and respond to incidents in corporate environments. It is aimed at professionals who perform cybersecurity analysis and operations roles.
What will I learn during the CompTIA CySA+ course?
You will learn to identify malicious activities, use threat hunting and threat intelligence tools, manage vulnerabilities, apply security controls, respond to incidents, and create reports for decision-making within an organization.
Does the course include hands-on labs?
Yes. The course includes official hands-on labs that allow you to apply the concepts learned in real-world cybersecurity scenarios. Participants will work with log analysis techniques, vulnerability assessment, network monitoring, incident management, and other common security analyst tasks.
Is the official material included?
Yes. The training includes official course material along with the associated hands-on labs, providing a complete learning experience geared toward preparing for the CompTIA CySA+ (CS0-003) exam.
Do I need previous experience in cybersecurity?
It is recommended to have basic knowledge of networks, operating systems, and information security fundamentals. It is also beneficial to have experience equivalent to CompTIA Security+ or practical experience in technical support, systems administration, or cybersecurity.
Does this course prepare me for the CompTIA CySA+ (CS0-003) exam?
Yes. The content and labs are aligned with the official CompTIA CySA+ (CS0-003) exam objectives, helping participants develop the technical competencies evaluated in the certification.
In what language are the materials and labs delivered?
Official materials and hands-on labs are available in English. It is recommended to have technical reading proficiency in this language to make the most of the training and associated documentation.
Which professional profiles can benefit from this course?
The course is aimed at cybersecurity analysts, systems administrators, network administrators, Security Operations Center (SOC) professionals, IT security managers, and any professional who wishes to specialize in threat detection and incident response.
Can the training be subsidized through FUNDAE?
Yes. Companies that meet the requirements established by the State Foundation for Employment Training (FUNDAE) can subsidize the cost of the training through their available training credits. Nanfor can advise on the subsidy management process.
What professional opportunities does the CompTIA CySA+ certification offer?
The CompTIA CySA+ certification is internationally recognized and helps validate knowledge in security analysis, vulnerability management, and incident response. It can be especially valuable for accessing or advancing in roles related to cybersecurity operations and SOC centers.
