Name: CompTIA CySA+ Exam Preparation Course (Self-Paced)
Price: 2949.0 USD
Availability: InStock

This course includes

24 hours of project-based training from experts
CySA+ exam voucher
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 2.4 CEUs

CompTIA and CySA+ are trademarks of CompTIA. This course is not affiliated with or endorsed by CompTIA, and passing the exam is not guaranteed.

This course is self-paced. For live online or in-person instruction, take CySA+ Exam Preparation Course.

This course prepares security analysts to sit the CompTIA CySA+ (CS0-004) exam, covering its four domains: security operations, vulnerability management, incident response and management, and reporting and communication.

Lessons follow the order an analyst works in, from recognizing malicious activity to prioritizing vulnerabilities and responding to incidents. Exercises use realistic artifacts such as event logs, and knowledge checks in every module build exam-day readiness.

Target Audience

This course is for security operations center analysts, vulnerability analysts, and other cybersecurity practitioners, in both federal agencies and commercial organizations, who are ready to prepare for the CompTIA CySA+ (CS0-004) certification exam. It assumes learners already have foundational networking and operating system knowledge and are comfortable with basic security concepts; CompTIA recommends roughly four years of hands-on experience in a SOC analyst (level 2) or vulnerability analyst role for this exam, though learners with a strong Security+ level foundation and independent practice can also succeed. This course is not for complete beginners with no networking, operating system, or security background at all; those learners should start with Networking Fundamentals for Security and Windows and Active Directory Security Fundamentals. It also is not a hands-on lab course: learners build and check their understanding through realistic screenshots, scenarios, and self-guided exercises rather than a hosted lab environment.

Tuition

Full Tuition

$2,949
Due before the class starts

This course includes

24 hours of project-based training from experts
CySA+ exam voucher
Answers from real instructors
Retake for free within 1 year
Verified digital certificate of completion
Learn at an accredited institution
Credits: 2.4 CEUs

Learning Experience Highlights

Training from government‑experienced instructors

Receive instruction from subject‑matter experts who bring proven government experience.

Specialized for government & DoD

Courses that are regularly updated based on feedback and industry developments, ensuring versions are mapped to federal competencies.

The instructor was wonderful and so knowledgeable. The course materials were extremely relevant to what my job is. I feel like I can be better because of this class.
— 2025 student

Three professionals sit in black chairs with laptops and notebooks, engaged in conversation against a red wall.

Real-world solutions

Directly addressing the day-to-day challenges of federal employees.

125+ departments & agencies served

Your trusted training partner, equipping public service professionals with the skills and knowledge to excel in their roles and drive meaningful impact.

100% Online. Start Anytime

24/7 access to our premium course videos and projects.
Industry experts are assigned as your course instructor. Message your instructor with any questions.
Participate in GSUSA online discussion forums — share ideas and receive additional support.
Hands-on quizzes and mini projects to test and reinforce concepts.

Earn a Certificate of Completion

Upon completion of this course, you’ll receive an official certificate testifying to your mastery of the curriculum. We’ll send you a link where you can download your certificate, share it online with your friends, post it to your professional network on LinkedIn, and view all your earned certificates. Congratulations on your achievement!

Shareable on

Sample credential for completion of CompTIA CySA+ Exam Preparation Course (Self-Paced)

A group of adult learners sits in a classroom, smiling and engaged in a government training session.

A government training instructor in a suit gestures while teaching in front of a whiteboard covered with notes and diagrams.

A person in professional attire holds a Graduate School USA folder, symbolizing participation in government training programs.

CompTIA CySA+ Exam Preparation Course (Self-Paced) Curriculum

What You'll Learn at a Glance

Explain security operations architecture concepts, including Zero Trust, SASE, IAM and PAM, and OT, ICS, and SCADA environments.
Recognize network, host, application, cloud, identity, and email indicators of malicious activity.
Select and interpret output from packet analysis, log analysis, threat intelligence, and endpoint security tools.
Apply MITRE ATT&CK, the Pyramid of Pain, and STRIDE to threat hunting and threat modeling.
Identify appropriate uses, risks, and governance considerations for AI in security operations.
Choose the appropriate vulnerability scanning method for a given asset and regulatory context.
Interpret findings from network, web application, cloud, and breach-and-attack-simulation tools.
Prioritize vulnerabilities using CVSS, EPSS, asset value, and exploitability.
Apply risk management strategies and control types to vulnerability management decisions.
Distinguish SAST from DAST and explain how software bills of materials address supply chain risk.
Apply the Cyber Kill Chain, the Diamond Model of Intrusion Analysis, and MITRE ATT&CK to analyze an attack.
Execute the incident response process from preparation through post-incident review.
Gather and preserve evidence, including chain of custody and legal hold requirements.
Perform root cause analysis and develop corrective actions following an incident.
Communicate vulnerability management and incident response findings to technical and executive stakeholders.

Course Syllabus

Download Syllabus PDF

Module 1: Security Operations Architecture Concepts

Lessons:
- Logging Fundamentals: Ingestion, Configuration, and Retention
- Operating System Hardening and File Structure Concepts
- Modern Infrastructure Architecture: Cloud, Virtualization, and Containers
- Network Architecture and Zero Trust Concepts: ZTNA, SASE, IAM, and PAM
- Data Protection, Encryption, and Critical Infrastructure: OT, ICS, and SCADA
Applied activity: Given a simplified network diagram and a log ingestion pipeline description, learners identify where Zero Trust controls, encryption, and log retention policies should be applied.

Module 2: Recognizing Indicators of Malicious Activity

Lessons:
- Network and Host Indicators of Compromise
- Living Off the Land Binaries, Scripts, and File System Changes
- Application and Cloud Indicators of Malicious Activity
- Identity-Based and Social Engineering Indicators: Impossible Travel, Business Email Compromise, and Typosquatting
Applied activity: Given a set of annotated screenshots, a process list, a firewall log excerpt, and an email header, learners classify each artifact by indicator category and justify the classification.

Module 3: Tools for Detecting Malicious Activity

Lessons:
- Packet and Log Analysis Tools: Wireshark, tcpdump, Snort, Suricata, Zeek, and SIEM
- Threat Intelligence Platforms and Endpoint Tools: OTX, MISP, OpenCTI, EDR/XDR, and MDM
- Reputation, File, and Sandbox Analysis: WHOIS, AbuseIPDB, VirusTotal, YARA, and Sandboxing
- Pattern Recognition and Email Analysis: Regular Expressions, Suspicious Commands, MXToolbox, and UEBA
- File Formats and Scripting for Analysts: JSON, XML, YAML, EVTX, Python, PowerShell, and Shell Script
Applied activity: Given a screenshot of Wireshark packet capture output and a corresponding EVTX log excerpt, learners identify the matching indicator and describe which additional tool they would use next and why.

Module 4: Threat Intelligence and Threat Hunting Concepts

Lessons:
- Threat Actors, TTPs, and the Pyramid of Pain
- MITRE ATT&CK and Attribution Confidence
- Threat Intelligence Collection and Sharing: OSINT and Closed-Source Sources
- Indicators of Compromise: Atomic and Behavioral Types
- Threat Modeling with STRIDE, Threat Mapping, and Cyber Deception
Applied activity: Given a short threat report excerpt, learners map the described activity to MITRE ATT&CK tactics and rate the source's confidence level using timeliness, relevance, and accuracy criteria.

Module 5: Process Improvement, Automation, and AI in Security Operations

Lessons:
- Standardizing and Streamlining Security Operations: Playbooks and Runbooks
- Automation and Orchestration: SOAR and Infrastructure as Code
- Alert Tuning, Dashboards, and Tool Integration
- AI Risks and Governance in Security Operations
- Practical AI Use Cases for Analysts
Applied activity: Given a sample SOAR playbook description and an AI chatbot transcript, learners identify one process-improvement opportunity and one AI governance risk, and recommend a mitigation for each.

Module 6: Vulnerability Scanning Methods

Lessons:
- Asset Inventory and Scan Planning Considerations
- Scan Types: Internal versus External, Agent versus Agentless, Credentialed versus Non-Credentialed
- Passive and Active Discovery: Mapping Scans and Device Fingerprinting
- Security Baseline Scanning: PCI DSS, CIS Benchmarks, and ISO/IEC 27000
Applied activity: Given a scenario describing a regulated environment with cardholder data present and a segmented network, learners choose the appropriate scan type, schedule, and baseline standard, and justify each choice.

Module 7: Analyzing Vulnerability Assessment Tool Output

Lessons:
- Network Scanning and Mapping Tool Output: Angry IP Scanner, Masscan, and Nmap
- Multipurpose Reconnaissance Tools: Metasploit Framework, Maltego, and Recon-ng
- Web Application Scanner Output: Burp Suite, ZAP, and Nikto
- Vulnerability and Cloud Assessment Tool Output: Nessus, Nuclei, OpenVAS, ScoutSuite, Prowler, Trivy, and Checkov
- Breach and Attack Simulation Output: Atomic Red Team and Caldera
Applied activity: Given annotated screenshots of an Nmap scan and a Nessus findings report for the same host, learners reconcile the two outputs and identify which findings require follow-up first.

Module 8: Prioritizing and Mitigating Vulnerabilities

Lessons:
- Prioritization Criteria: Exploitability, Asset Value, and Impact
- Scoring Methods: CVSS and EPSS
- Context Awareness and False Positive and Negative Analysis
- Mitigation Strategies and Validating Remediation
Applied activity: Given a short list of scored vulnerabilities with CVSS, EPSS, and asset criticality noted, learners rank them for remediation and justify the ranking, then propose a compensating control for one item that cannot be patched immediately.

Module 9: Controls, Risk, and Vulnerability Management Governance

Lessons:
- Control Types and Control Functions
- Risk Concepts and Risk Management Strategies
- Policies, Governance, and Service-Level Objectives
- Application Security: SAST, DAST, and SAMM
- Third-Party and Supply Chain Risk: SCA and SBOM
Applied activity: Given a described application vulnerability found late in development, learners classify the control gap, recommend a risk management strategy, and identify whether SAST or DAST would have caught it earlier.

Module 10: Attack Methodology Frameworks

Lessons:
- The Cyber Kill Chain
- The Diamond Model of Intrusion Analysis
- Applying MITRE ATT&CK to Incident Analysis
Applied activity: Given a short narrative of an attack, learners map the events to Cyber Kill Chain stages and to the Diamond Model's core features.

Module 11: The Incident Response Process

Lessons:
- Preparation and Detection
- Analysis and Containment
- Eradication and Recovery
- Post-Incident Activities
Applied activity: Given a timeline of an incident, learners label each described action with the correct incident response phase.

Module 12: Incident Response Planning, Roles, and Evidence Handling

Lessons:
- Developing Incident Response and Communication Plans
- Playbooks, Roles, and Training: Tabletop and Simulation Exercises
- Log Collection, Correlation, and Enrichment
- Triage: Timeline, Severity, and Prioritization
- Evidence Gathering: Chain of Custody, Preservation, and Legal Hold
Applied activity: Given a set of raw, unordered log entries from different systems, learners correlate them into a timeline, assign a severity rating, and describe the chain-of-custody steps needed to preserve the evidence.

Module 13: Containment, Eradication, Recovery, and Root Cause Analysis

Lessons:
- Isolating Affected Targets and Escalation
- Remediation, Verification, and Release from Isolation
- Performing Restoration
- Root Cause Analysis and Corrective Action Development
Applied activity: Given a described incident that recurs after an initial fix, learners perform a root cause analysis, identify the true underlying cause, and propose a corrective action distinct from the original fix.

Module 14: Vulnerability Management Reporting and Communication

Lessons:
- Vulnerability Scan Reports, Compliance Findings, and Risk Scorecards
- Action Plans, Escalation, and Dependencies
- Inhibitors to Remediation: Legacy Systems, Contracts, and Business Impact
- Stakeholder Identification and Communication
- Metrics, KPIs, Trends, and Service-Level Agreements
Applied activity: Given a mock vulnerability scorecard and a remediation delay caused by a legacy system, learners draft a short stakeholder communication that explains the inhibitor, the risk, and the proposed action plan.

Module 15: Security Operations and Incident Response Reporting and Communication

Lessons:
- Incident Declaration, Escalation, and Shift Handover
- Executive Summaries and Internal Threat Intelligence Reporting
- Stakeholder Communication: Legal, Public Relations, Regulators, Law Enforcement, and Customers
- Post-Incident Reporting: After Action Reports and Lessons Learned
- Security Operations Metrics and KPIs: Mean Time to Detect, Respond, and Remediate
Applied activity: Given a completed incident timeline, learners draft a one-paragraph executive summary, identify which three stakeholders must be notified and why, and calculate a mean-time-to-respond figure from provided timestamps.

Group Training

Since 1921, Graduate School USA has partnered with over 125 federal agencies and trained more than one million federal employees. Led by instructors with deep, real-world knowledge of federal regulations, policies, and practices, our private group programs are practical, mission-driven, and tailored to your agency’s objectives. We offer expertise across key federal domains—including human resources, financial management, acquisition and contracting, leadership, and more—to deliver training where and how your team needs it.

Complete this form and we’ll get back to you within 1 business hour.

The Fact Is – We’ve Been Government’s Training Partner Since 1921

400+ Courses & Certificates 125+ Federal Agencies Served 200+ Subject-Matter Experts

Installments
	10% non-refundable deposit
$2,949.00	Total You Pay