Learning objectives

Log ingestion–Part 1

Log ingestion–Part 2

Operating system (OS) concepts

Infrastructure concepts

Network architecture

Encryption

Sensitive data protection

Identity and access management

Network-related

Application-related

Host-related

Other

Tools–Part 2

Common techniques

Tools

Common techniques–Part 2

Programming languagesscripting

Common techniques–Part 3

Threat actors

Threat actors-Part 2

Collection methods and sourcesConfidence levels

Threat hunting

Standardize processes

Streamline operations

Technology and tool integration

Asset discovery

Special considerations

Internal versus external scanning

Agent versus agentless

Credentialed versus non-credentialed

Passive versus active

Static versus dynamic

Critical infrastructure

Critical infrastructure–Part 2

Network scanning and mapping

Web application scanners

Vulnerability scanners

Debuggers

Multipurpose

Secure coding best practices

Cloud infrastructure assessment

Input validation

Session management

Output encoding

Authentication

Validation

Context awareness

Common Vulnerability Scoring System (CVSS) interpretation

Exploitabilityweaponization

Asset value

Zero-day

Overflow vulnerabilities

Data poisoning

Cross-site scripting

Broken access control

Injection flaws

Directory traversal

Cryptographic failures

Cross-site request forgery

Insecure design

Server-side request forgery

End-of-life or outdated components

Identification and authentication failures

Remote code execution

Privilege escalation

Local file inclusion (LFI)remote file inclusion (RFI)

Security misconfiguration

Compensating controls

Maintenance windows

Patching and configuration management

Control types

Exceptions

Policies, governance, and service-level objectives (SLOs)

Risk management principles

Attack surface management

Prioritization and escalation

Secure coding best practices

Secure software development life cycle (SDLC)

Threat modeling

Diamond Model of Intrusion Analysis

Cyber kill chains

Open Source Security Testing Methodology Manual (OSS TMM)

OWASP Testing Guide

MITRE ATT&CK

MITRE ATT&CK–Part 2

Detection and analysis

Containment, eradication, and recovery

Preparation

Post-incident activity

Vulnerability management reporting

Action plans

Compliance reports

Inhibitors to remediation

Stakeholder identification and communication

Metrics and key performance indicators (KPIs)

Understanding the test

Increasing your chances for passing the test

Types of test questions

Module Introduction

What I learned

CompTIA Cybersecurity Analyst (CySA+) CS0-003 Summary