CompTIA CySA+ Cheat Sheet (2026): Key Concepts + Exam Traps

Core Framework

CySA+ Threat Analysis Framework

CySA+ (CS0-003) tests security analyst skills: reading and interpreting security tool outputs, correlating events to identify threats, and making evidence-based incident response decisions. The exam includes performance-based questions requiring interpretation of log files, network captures, and vulnerability scan outputs.

01
Threat Intelligence — Indicators of compromise, threat actor profiling, threat feeds
02
Threat Hunting — Proactive hypothesis-driven threat identification
03
Incident Response — Detection, analysis, containment, eradication, recovery
04
Vulnerability Management — Scanning, prioritization, remediation tracking
05
Security Architecture — Defense-in-depth, SIEM/SOAR integration, monitoring design

Scenario Traps

Wrong instinct vs correct approach

A SIEM alert fires for suspicious outbound traffic to an unknown IP

✕ Wrong instinct

Block the IP immediately at the firewall

✓ Correct approach

Analyze first: check threat intelligence feeds for IP reputation, review traffic volume and timing, correlate with other events from the same source, examine the affected endpoint — blocking before analysis may alert the attacker and destroy evidence

A vulnerability scan shows a critical CVE on a DMZ server

✕ Wrong instinct

Immediately patch the server to remediate the critical vulnerability

✓ Correct approach

Assess exploitability in context: is there a public exploit? Is the service internet-exposed? Is there a compensating control? Prioritize by actual risk, not just CVSS score

Log analysis shows a user logged in at 3am from an unusual location

✕ Wrong instinct

Lock the account immediately to prevent unauthorized access

✓ Correct approach

Investigate before acting: check whether travel or remote work explains the location, correlate with other authentication events, look for subsequent suspicious activity — premature lockout disrupts legitimate users and tips off attackers

Quick Rules

Know these cold

▸ Analyze before responding — evidence-based decisions prevent mistakes under pressure
▸ IoCs = past compromise evidence; IoAs = active attack behaviors — IoAs enable earlier detection
▸ MITRE ATT&CK — actics (goals) → Techniques (methods) → Sub-techniques (specifics)
▸ Vulnerability prioritization = CVSS score + asset criticality + exploitability + threat context
▸ Threat hunting is proactive — develop a hypothesis, collect data, analyze, report findings
▸ SIEM correlation rules reduce alert fatigue — tune continuously to reduce false positives
▸ Threat intelligence feeds enrich alerts — integrate TI with SIEM for context-aware alerting

Self Check

Can you answer these without checking your notes?

In this scenario: "A SIEM alert fires for suspicious outbound traffic to an unknown IP" — what should you do first?

Analyze first: check threat intelligence feeds for IP reputation, review traffic volume and timing, correlate with other events from the same source, examine the affected endpoint — blocking before analysis may alert the attacker and destroy evidence

In this scenario: "A vulnerability scan shows a critical CVE on a DMZ server" — what should you do first?

Assess exploitability in context: is there a public exploit? Is the service internet-exposed? Is there a compensating control? Prioritize by actual risk, not just CVSS score

In this scenario: "Log analysis shows a user logged in at 3am from an unusual location" — what should you do first?

Investigate before acting: check whether travel or remote work explains the location, correlate with other authentication events, look for subsequent suspicious activity — premature lockout disrupts legitimate users and tips off attackers

Failure Patterns

Common Exam Mistakes — What candidates get wrong

Responding to incidents before completing analysis

CySA+ emphasizes evidence-based response. Candidates who jump to containment before completing threat analysis risk containing the wrong threat or missing lateral movement. Analyze, confirm, then respond — in that order.

Confusing indicators of compromise with indicators of attack

IoCs are evidence that a compromise has already occurred (hashes, IPs, domain names). IoAs are behaviors that suggest an attack is in progress (unusual process execution, lateral movement patterns). IoAs enable earlier detection but are harder to operationalize.

Misidentifying MITRE ATT&CK tactic vs. technique

MITRE ATT&CK Tactics are high-level goals (Initial Access, Lateral Movement, Exfiltration). Techniques are specific methods to achieve them (Spearphishing Attachment under Initial Access). Candidates who confuse these levels miss threat correlation questions.

Treating vulnerability score as the only prioritization factor

CVSS score measures technical severity, not business risk. Vulnerability prioritization must also consider asset criticality, exploitability in context, and existing compensating controls. A high CVSS score on a non-critical isolated system may be lower priority than a medium on an internet-facing critical system.

Ignoring the threat hunting domain

CySA+ CS0-003 increased the weight of threat hunting. Candidates who study only reactive incident response miss proactive threat hunting methodology questions.