Skip to content
Certification Guides

CompTIA CySA+ Study Guide, 3rd Edition (2023)

Get ahead with CompTIA CySA+ Study Guide, 3rd Edition (2023), a structured practice test that helps you analyze your strengths and weaknesses.

Preview 16 of 579 pages

See the first 16 pages exactly as they appear in the document.

  1. Page 1
    Read page 1 as text

    Third Edition Save 10% on CompTIA® Exam Vouchers Coupon Inside! @® CompTIA EXAM CS0-003 Includes one year of FREE access after activation to the online test bank and study tools: Custom practice exam 100 electronic flashcards Searchable key term glossary MIKE CHAPPLE (= DAVID SEIDL + study |

  2. Page 2
    Read page 2 as text

    Downloaded from StudyXY.com ® + StudyXY Sd Ye. o> \ | iF ’ pr E \ 3 S Stu dy Anything This ContentHas been Posted On StudyXY.com as supplementary learning material. StudyXY does not endrose any university, college or publisher. Allmaterials posted are under the liability of the contributors. wv 8) www.studyxy.com

  3. Page 3
  4. Page 4
    Read page 4 as text

    (up to a $35 value) *Some restrictions apply. See web page for details. Get details at www.wiley.com/go/sybextestprep To get the discount code, you'll need to register and log on the test bank. Then go to Resources. CusBex

  5. Page 5
  6. Page 6
    Read page 6 as text

    CompTIA’ CySA+ Study Guide Exam CS0-003 Third Edition ET Dy = 4 RE De = = aii Mike Chapple David Seidl

  7. Page 7
    Read page 7 as text

    Copyright © 2023 by John Wiley & Sons, Inc. All rights reserved. Published by John Wiley & Sons, Inc., Hoboken, New Jersey. Published simultaneously in Canada and the United Kingdom. ISBNs: 9781394182909 (paperback), 9781394182923 (ePDF), 9781394182916 (ePub) No part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 750-4470, or on the web at ww copyright. com. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at www. wiley. com/go/permission. Trademarks: WILEY, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. CompTIA is a registered trademark of CompTIA, Inc. All other trademarks are the property of their respective owners. John Wiley & Sons, Inc. is nor associated with any product or vendor mentioned in this book. Limit of Liability/Disclaimer of Warranty: While the publisher and authors have used their best efforts in preparing this book, they make no representations or warranties with respect to the accuracy or completeness of the contents of this book and specifically disclaim any implied warranties of merchantability or fitness for a particular purpose. No warranty may be created or extended by sales representatives or written sales materials. The advice and strategies contained herein may not be suitable for your situation. You should consult with a professional where appropriate. Further, readers should be aware that websites listed in this work may have changed or disappeared between when this work was written and when it is read. Neither the publisher nor authors shall be liable for any loss of profit or any other commercial damages, including but not limited to special, incidental, consequential, or other damages. For general information on our other products and services or for technical support, please contact our Customer Care Department within the United States at (800) 762-2974, outside the United States at (317) 572-3993 or fax (317) 572-4002. Wiley also publishes its books in a variety of electronic formats. Some content that appears in print may not be available in electronic formats. For more information about Wiley products, visit our web site at www. wi Ley . com. Library of Congress Control Number: 2022951784 Cover image: © Jeremy Woodhouse/Getty Images, Inc. Cover design: Wiley Study

  8. Page 8
    Read page 8 as text

    I dedicate this book to my father, who was a role model of the value of hard work, commitment to family, and the importance of doing the right thing. Rest in peace, Dad. —Mike Chapple This book is dedicated to Ric Williams, my friend, mentor, and partner in crime through my first forays into the commercial IT world. Thanks for making my job as a “network janitor” one of the best experiences of my life. —David Seidl | \ TT StudyXY

  9. Page 9
    Read page 9 as text

    Acknowledgments Books like this involve work from many people, and as authors, we truly appreciate the hard work and dedication that the team at Wiley shows. We would especially like to thank senior acquisitions editor Kenyon Brown. We have worked with Ken on multiple projects and con- sistently enjoy our work with him. We also greatly appreciated the editing and production team for the book, including Lily Miller, our project editor, who brought years of experience and great talent to the project; Chris Crayton, our technical editor, who provided insightful advice and gave won- derful feedback throughout the book; Archana Pragash, our production editor, who guided us through layouts, formatting, and final cleanup to produce a great book; and Elizabeth ‘Welch, our copy editor, who helped the text flow well. We would also like to thank the many behind-the-scenes contributors, including the graphics, production, and technical teams who make the book and companion materials into a finished product. Our agent, Carole Jelen of Waterside Productions, continues to provide us with wonderful opportunities, advice, and assistance throughout our writing careers. Finally, we would like to thank our families and significant others who support us through the late evenings, busy weekends, and long hours that a book like this requires to write, edit, and get to press.

  10. Page 10
    Read page 10 as text

    About the Authors Mike Chapple, Ph.D., Security+, CySA+, CISSP, is author of over 50 books, including the best-selling CISSP (ISC)? Certified Information Systems Security Professional Official Study Guide (Sybex, 2021) and the CISSP (ISC)* Official Practice Tests (Sybex, 2021). He is an information security professional with two decades of experience in higher education, the private sector, and government. Mike currently serves as a Teaching Professor in the IT, Analytics, and Operations department at the University of Notre Dame’s Mendoza College of Business, where he teaches undergraduate and graduate courses on cybersecurity, data management, and business analytics. Before returning to Notre Dame, Mike served as executive vice president and chief information officer of the Brand Institute, a Miami-based marketing consultancy. Mike also spent four years in the information security research group at the National Security Agency and served as an active duty intelligence officer in the U.S. Air Force. Mike earned both his B.S. and Ph.D. degrees from Notre Dame in computer science and engineering. Mike also holds an M.S. in computer science from the University of Idaho and an MBA from Auburn University. Mike holds certifications in Cybersecurity Analyst+ (CySA+), Security+, Certified Information Security Manager (CISM), Certified Cloud Security Professional (CCSP), and Certified Information Systems Security Professional (CISSP). He provides security certification resources on his website at CertMike. com. David Seidl, CySA+, CISSP, PenTest+, is Vice President for Information Technology and CIO at Miami University. During his IT career, he has served in a variety of technical and information security roles, including serving as the Senior Director for Campus Technology Services at the University of Notre Dame where he co-led Notre Dame’s move to the cloud and oversaw cloud operations, ERP, databases, identity management, and a broad range of other technologies and service. He also served as Notre Dame’s Director of Information Security and led Notre Dame’s information security program. He has taught information security and networking undergraduate courses as an instructor for Notre Dame’s Men- doza College of Business, and he has written 18 books on security certification and cyber- warfare, including co-authoring CISSP (ISC)> Official Practice Tests (Sybex, 2021) as well as the previous editions of both this book and the companion CompTIA CySA+ Practice Tests (Sybex, 2020, 2018). David holds a bachelor’s degree in communication technology and a master’s degree in information security from Eastern Michigan University, as well as certifications in CISSP, CySA+, Pentest+, GPEN, and GCIH.

  11. Page 11
    Read page 11 as text

    About the Technical Editor Chris Crayton, MCSE, CISSP, CASP, CySA+, A+, N+, S+, is a technical consultant, trainer, author, and industry-leading technical editor. He has worked as a computer technology and networking instructor, information security director, network administrator, network engineer, and PC specialist. Chris has served as technical editor and content contributor on numerous technical titles for several of the leading publishing companies. He has also been recognized with many professional and teaching awards. | ve T= StudyXY

  12. Page 12
    Read page 12 as text

    Contents at a Glance Introduction xxi Assessment Test xxXxXV Domain | Security Operations 1 Chapter 1 Today's Cybersecurity Analyst 3 Chapter 2 System and Network Architecture 37 Chapter 3 Malicious Activity 77 Chapter 4 Threat Intelligence 135 Chapter 5 Reconnaissance and Intelligence Gathering 159 Domain II Vulnerability Management 201 Chapter 6 Designing a Vulnerability Management Program 203 Chapter 7 Analyzing Vulnerability Scans 245 Chapter 8 Responding to Vulnerabilities 293 Domain Ill Incident Response and Management 341 Chapter 9 Building an Incident Response Program 343 Chapter 10 Incident Detection and Analysis 377 Chapter 11 Containment, Eradication, and Recovery 397 Domain IV Reporting and Communication 421 Chapter 12 Reporting and Communication 423 Chapter 13 Performing Forensic Analysis and Techniques for Incident Response 447 Appendix Answers to Review Questions 489 Index 513 | v 1 StudyXY

  13. Page 13
  14. Page 14
    Read page 14 as text

    Contents Introduction xxi Assessment Test xxXxXV Domain | Security Operations 1 Chapter 1 Today's Cybersecurity Analyst 3 Cybersecurity Objectives 4 Privacy vs. Security 5 Evaluating Security Risks 6 Identify Threats 9 Identify Vulnerabilities 10 Determine Likelihood, Impact, and Risk 10 Reviewing Controls 12 Building a Secure Network 12 Network Access Control 12 Firewalls and Network Perimeter Security 14 Network Segmentation 17 Defense Through Deception 18 Secure Endpoint Management 19 Hardening System Configurations 19 Patch Management 19 Group Policies 20 Endpoint Security Software 20 Penetration Testing 21 Planning a Penetration Test 22 Conducting Discovery 23 Executing a Penetration Test 23 Communicating Penetration Test Results 24 Training and Exercises 24 Reverse Engineering 25 Isolation and Sandboxing 25 Reverse Engineering Software 25 Reverse Engineering Hardware 26 Efficiency and Process Improvement 27 Standardize Processes and Streamline Operations 28 Cybersecurity Automation 28 Technology and Tool Integration 29 Bringing Efficiency to Incident Response 29

  15. Page 15
    Read page 15 as text

    xii Contents The Future of Cybersecurity Analytics 31 Summary 31 Exam Essentials 32 Lab Exercises 33 Activity 1.1: Create an Inbound Firewall Rule 33 Activity 1.2: Create a Group Policy Object 34 Activity 1.3: Write a Penetration Testing Plan 35 Activity 1.4: Recognize Security Tools 36 Chapter 2 System and Network Architecture 37 Infrastructure Concepts and Design 38 Serverless 38 Virtualization 39 Containerization 39 Operating System Concepts 41 System Hardening 41 The Windows Registry 42 File Structure and File Locations 43 System Processes 44 Hardware Architecture 45 Logging, Logs, and Log Ingestion 45 Time Synchronization 45 Logging Levels 46 Network Architecture 47 On-Premises 47 Cloud 48 Hybrid 49 Network Segmentation 49 Software-Defined Networking 51 Zero Trust 52 Secure Access Service Edge 52 Identity and Access Management 53 Multifactor Authentication (MFA) 54 Passwordless 55 Single Sign-On (SSO) 5s Federation 56 Federated Identity Security Considerations 57 Federated Identity Design Choices 59 Federated Identity Technologies 61 Privileged Access Management (PAM) 64 Cloud Access Security Broker (CASB) 65 Encryption and Sensitive Data Protection 65 Public Key Infrastructure (PKI) 66 Secure Sockets Layer (SSL) Inspection 67

  16. Page 16
    Read page 16 as text

    Contents xiii Data Loss Prevention (DLP) 68 Personally Identifiable Information (PII) 68 Cardholder Data (CHD) 68 Summary 68 Exam Essentials 70 Lab Exercises 70 Activity 2.1: Set Up Virtual Machines for Exercises 70 Activity 2.2: Explore the Windows Registry 71 Activity 2.3: Review System Hardening Guidelines 72 Review Questions 73 Chapter 3 Malicious Activity 77 Analyzing Network Events 78 Capturing Network-Related Events 79 Detecting Common Network Issues 82 Detecting Scans and Sweeps 86 Detecting Denial-of-Service and Distributed Denial-of-Service Attacks 87 Detecting Other Network Attacks 88 Detecting and Finding Rogue Devices 88 Investigating Host-Related Issues 91 System Resources 91 Malware, Malicious Processes, and Unauthorized Software ~~ 95 Unauthorized Access, Changes, and Privileges 97 Social Engineering 99 Investigating Service- and Application-Related Issues 100 Application and Service Monitoring 100 Determining Malicious Activity Using Tools and Techniques ~~ 104 Logs, Log Analysis, and Correlation 105 Logs 105 Security Appliances and Tools 110 Packet Capture 111 DNS and Whois Reputation Services 112 Common Techniques 114 Protecting and Analyzing Email 115 File Analysis 119 Sandboxing 120 User Behavior Analysis 121 Data Formats 121 Summary 126 Exam Essentials 127 Lab Exercises 128 Activity 3.1: Identify a Network Scan 128

563 more pages in the full document

Unlock it once and it stays in your library, ready to chat with or turn into flashcards.

Unlock the full document

More CompTIA Certifications study materials

See all

Study this document with CramX

Once it is in your library, every tool can work from it.