CompTIA CySA+: preparing for analyst-level log, vulnerability, and incident questions

What CySA+ emphasizes

CySA+ targets analysts. It focuses on security operations such as reading logs and identifying malicious activity, vulnerability management including prioritizing scan findings, incident response and management, and reporting and communication. Questions often present output and ask what it means or what to do next.

• Security operations: logs, network traffic, endpoint data
• Vulnerability management: scanning, prioritizing, remediating
• Incident response: phases, containment, evidence
• Reporting: metrics, stakeholders, communication

Practice with real artifacts

The fastest way to prepare is to read many real artifacts: Windows Security and Sysmon events, firewall and proxy logs, vulnerability scanner reports, and email headers. For each, practice saying what happened and what you would do next.

artifact: 4625 events, 380 failures for 60 different accounts from 203.0.113.9 in 10 min
what happened: password spraying against many accounts
next: block source, check for any 4624 success from that IP, review MFA coverage

Lab: prioritize a vulnerability scan

Scan your own lab with an open-source scanner such as OpenVAS or Nessus Essentials. Export the findings and rank the top ten by severity, exploitability (for example, whether the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog), and asset importance. Write the remediation and owner for each, which mirrors many CySA+ scenarios.

finding | CVSS | in KEV | asset | priority | remediation
OpenSSH outdated on web01 | 8.1 | no | internet-facing | high | patch to vendor-supported version
SMBv1 enabled on ws01 | 8.1 | yes | internal | high | disable SMBv1 via GPO
self-signed cert on siem | 5.3 | no | internal | low | replace with internal CA cert

Reporting and communication

Expect questions about which metric or report suits which audience: technical details for engineers, risk and trend summaries for management, and timelines for incident stakeholders. Practice turning one incident into a two-sentence executive summary.