Overview
Domain 3 covers the analyst's role once something has gone wrong. It starts with attack methodology frameworks: the Cyber Kill Chain, the Diamond Model of Intrusion Analysis and MITRE ATT&CK. It covers the incident response process: preparation, detection, analysis, containment, eradication, recovery and post-incident activity. It then covers the techniques for carrying that process out: developing incident response and communication plans, creating playbooks, defining roles, training through tabletops and simulations, collecting, correlating and enriching logs, alerts, triage, building a timeline, determining severity and impact, prioritization, gathering evidence with chain of custody, integrity validation, preservation and legal hold, isolating affected targets, escalation, remediation and verification, release from isolation, restoration, root cause analysis and corrective action.
The domain begins where Domain 1's detection leaves off, and it feeds Domain 4's incident reporting, metrics and lessons learned.
How it's tested
Expect scenarios set during an active incident that ask what to do FIRST or NEXT, which framework fits an analysis need, or how to handle evidence. Performance-based items may ask you to order response steps or build a timeline from log entries.
-
Next step in the process
An incident is at a given stage, and you must pick the correct next action without skipping ahead.
-
Which framework?
An analysis task is described, such as mapping stages, linking actors to infrastructure or naming techniques, and you must choose the Kill Chain, Diamond Model or ATT&CK.
-
Evidence and release
A decision about evidence handling, legal hold or returning a system to production is required.
An analyst has isolated a compromised web server and removed a web shell. The application owner wants it back online now. Releasing from isolation is tempting because the known malware is gone. But without root cause analysis and verification, the vulnerability that let the attacker in may still be open. The correct sequence is to fix and verify the entry point, check for persistence, and only then release and restore.
Objectives 3
Official objectives from the CompTIA outline, in outline order.
3.1 Summarize concepts related to attack methodology frameworks.Cyber Kill Chain, Diamond Model of Intrusion Analysis and MITRE ATT&CK.
- What it means
- The Cyber Kill Chain describes an intrusion as a sequence of stages: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives. The Diamond Model analyzes intrusions through four connected features: adversary, capability, infrastructure and victim. MITRE ATT&CK is a knowledge base of adversary tactics and techniques observed in real attacks.
- What to understand
- Each framework answers a different question. The Kill Chain helps you see where an attack can be broken. The Diamond Model helps pivot between related elements, for example from known infrastructure to other victims. ATT&CK gives a detailed, shared vocabulary for mapping detections and gaps.
- How it shows up
- Questions describe an analysis goal and ask which framework fits, or ask which stage or tactic a described activity represents.
- Common confusion
- Treating ATT&CK as a linear sequence like the Kill Chain. ATT&CK is a matrix of tactics and techniques, and attackers do not move through it in a fixed order.
3.2 Summarize the incident response process.Preparation, detection, analysis, containment, eradication, recovery and post-incident.
- What it means
- The process runs from preparation (plans, tools, training) through detection, analysis, containment, eradication and recovery, to post-incident activities such as lessons learned.
- What to understand
- Order matters. Analysis determines scope before containment choices are made. Containment limits damage before eradication removes the cause, and recovery happens only once the environment is clean. Post-incident review improves preparation, closing the loop.
- How it shows up
- A scenario describes an incident at a particular point and asks which phase it is in or what comes next.
- Common confusion
- Jumping to eradication or recovery before containment, which can alert the attacker or allow reinfection.
3.3 Given a scenario, implement incident response techniques.Plans, playbooks, roles, training, log work, triage, timelines, severity, evidence, isolation, escalation, remediation, restoration and RCA.
- What it means
- This objective lists the practical techniques: developing incident response and communication plans, creating playbooks, defining roles, training with tabletops and simulations, collecting, correlating and enriching logs, handling alerts and notifications, triage, building a timeline, determining severity and impact, prioritization, gathering evidence with chain of custody, data integrity validation, preservation and legal hold, isolating affected targets, escalation, remediation and verification, release from isolation, restoration, root cause analysis (RCA) and developing corrective actions.
- What to understand
- Triage and severity assessment decide which incidents get attention first. A timeline built from correlated logs shows how the attack unfolded. Evidence must be preserved with integrity checks such as hashes and a chain of custody, and legal hold prevents deletion. Systems are released from isolation only after remediation is verified. RCA finds the true cause, and corrective actions prevent recurrence.
- How it shows up
- Questions present a specific technical moment, such as several alerts at once, a request to restore, a legal request or a need to reconstruct events, and ask for the BEST action.
- Common confusion
- Treating removal of malware as the end of the incident. Without RCA and corrective action, the entry point remains.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Cyber Kill Chain stages
Reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives.
- Remember
- Breaking any stage can stop the attack, and earlier is better.
- Tested as
- Stage identification questions.
- Trap
- Confusing delivery with exploitation.
-
Diamond Model
Adversary, capability, infrastructure and victim, linked as a diamond.
- Remember
- It supports pivoting between related elements during analysis.
- Tested as
- Framework selection questions.
- Trap
- Using it to describe attack stages.
-
MITRE ATT&CK
A matrix of adversary tactics and techniques based on real-world observations.
- Remember
- Tactics are the why, and techniques are the how.
- Tested as
- Mapping and gap analysis questions.
- Trap
- Treating it as a fixed sequence.
-
Incident response phases
Preparation, detection, analysis, containment, eradication, recovery, post-incident.
- Remember
- Contain before eradicating, and eradicate before recovering.
- Tested as
- Sequencing questions.
- Trap
- Restoring systems before the threat is removed.
-
Triage
Rapidly assessing incidents to decide priority and handling.
- Remember
- Severity combines impact on the business with the scope of compromise.
- Tested as
- Prioritization questions.
- Trap
- Handling incidents in arrival order.
-
Timeline
A chronological reconstruction of events from correlated logs.
- Remember
- It depends on synchronized time across sources.
- Tested as
- Analysis questions.
- Trap
- Mixing time zones or unsynchronized clocks.
-
Chain of custody
Documentation of who handled evidence, when and how.
- Remember
- Combined with hash validation, it proves evidence integrity.
- Tested as
- Evidence questions.
- Trap
- Passing evidence informally between team members.
-
Legal hold
A requirement to preserve relevant data for litigation or investigation.
- Remember
- It overrides normal deletion and retention schedules.
- Tested as
- Evidence questions.
- Trap
- Letting routine log rotation delete held data.
-
Release from isolation
Returning a contained system to normal operation.
- Remember
- Only after remediation is verified and persistence is ruled out.
- Tested as
- Recovery sequencing questions.
- Trap
- Releasing as soon as known malware is removed.
-
Root cause analysis
Identifying the underlying cause that allowed the incident.
- Remember
- Corrective actions should address the root cause, not just the symptoms.
- Tested as
- Post-incident questions.
- Trap
- Stopping at the immediate trigger.
-
Tabletop vs. simulation
A tabletop discusses a scenario. A simulation exercises it more realistically, often with live tools.
- Remember
- Both are training techniques listed in 3.3.
- Tested as
- Preparation questions.
- Trap
- Running a disruptive simulation as the first exercise.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Cyber Kill Chain vs. Diamond Model vs. MITRE ATT&CK
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Cyber Kill Chain | Linear stages of an intrusion | Shows where to break the attack | Assuming every attack follows it neatly |
| Diamond Model | Relationships between adversary, capability, infrastructure and victim | Supports pivoting during analysis | Using it to order attack stages |
| MITRE ATT&CK | Matrix of tactics and techniques | Detailed, shared vocabulary for behaviors | Treating it as a sequence |
Containment vs. eradication vs. recovery
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Containment | Limit the spread and impact | Stops the damage growing | Skipping it to restore faster |
| Eradication | Remove malware, accounts and persistence | Removes the threat | Missing persistence mechanisms |
| Recovery | Restore and monitor systems back in production | Returns service safely | Restoring into a still-compromised environment |
Remediation vs. root cause analysis vs. corrective action
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Remediation | Fixing the affected systems | Addresses this incident | Not verifying the fix |
| Root cause analysis | Finding why the incident was possible | Explains the underlying cause | Stopping at the symptom |
| Corrective action | Changes that prevent recurrence | Improves defenses going forward | Never assigning owners and deadlines |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Release early
- What candidates pick
- Return the server to production as soon as the web shell is removed.
- Why it looks right
- The visible malware is gone and the business wants it back.
- Why it's wrong
- Without verifying the entry point is closed and persistence removed, the attacker may return immediately.
Clue to watch for The scenario has not mentioned root cause or verification.
-
Eradicate first
- What candidates pick
- Delete the attacker's accounts before isolating affected systems.
- Why it looks right
- Removing access sounds decisive.
- Why it's wrong
- Without containment and scoping, the attacker may notice and use other footholds. Contain and scope first.
Clue to watch for The full scope of the compromise is not yet known.
-
First come, first served
- What candidates pick
- Handle incidents in the order the alerts arrived.
- Why it looks right
- It seems fair and orderly.
- Why it's wrong
- Triage should prioritize by severity and impact, so a ransomware outbreak outranks an earlier low-impact alert.
Clue to watch for Several incidents of different severity are described.
-
Wrong framework
- What candidates pick
- Use the Cyber Kill Chain to link a known attacker's infrastructure to other victims.
- Why it looks right
- The Kill Chain is the best-known framework.
- Why it's wrong
- Pivoting between adversary, infrastructure, capability and victim is what the Diamond Model is designed for.
Clue to watch for The task involves relationships or pivoting rather than stages.
-
Routine deletion
- What candidates pick
- Let logs rotate on their normal schedule during an investigation.
- Why it looks right
- Retention policy is being followed.
- Why it's wrong
- If legal hold applies, relevant data must be preserved regardless of the retention schedule.
Clue to watch for Legal counsel, litigation or law enforcement is mentioned.
-
Fix the symptom
- What candidates pick
- Close the incident after reimaging the infected workstation.
- Why it looks right
- The infected machine is clean.
- Why it's wrong
- Without root cause analysis and corrective action, the same phishing gap or vulnerability will cause the next incident.
Clue to watch for The incident has happened before, or the question asks what is missing.
Answer framework
For any Domain 3 incident scenario, use these steps to find the answer CySA+ expects.
- Identify the current phase of the incident response process, and choose the next step rather than skipping ahead to recovery.
- Triage by severity and business impact, building a timeline from correlated, time-synchronized logs to understand scope.
- Contain affected targets while preserving evidence, validating integrity with hashes, maintaining chain of custody and applying legal hold where required.
- Remediate, then verify the fix, removing persistence and closing the entry point before releasing anything from isolation.
- Finish with root cause analysis and corrective actions, choosing the framework that fits the analysis: Kill Chain, Diamond Model or ATT&CK, and make sure every corrective action has an owner.
Practice question
Want more like this? The CySA+ practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with the process in 3.2 and learn it as a strict sequence. Practice reading short scenarios and naming the current phase and the next action. Then move to 3.3, which is long but practical. Group its items into four clusters: preparation (plans, playbooks, roles, training), analysis (logs, triage, timeline, severity), evidence (custody, integrity, preservation, legal hold), and resolution (isolation, escalation, remediation, release, restoration, RCA, corrective action).
Next, study the frameworks in 3.1 side by side. For each, write the question it answers. Candidates commonly confuse the Diamond Model with ATT&CK, so practice choosing between them.
Candidates also underestimate the release-from-isolation and root cause steps, which produce many sequencing traps. Know that verification comes before release, and that RCA and corrective action come before closure.
Afterwards, take mixed practice with Domain 1 and Domain 4. Detection starts the incident, and reporting closes it with metrics and lessons learned. Review missed questions by naming the phase you skipped.
FAQ
How much of CySA+ CS0-004 is Domain 3?
Incident Response and Management is 24% of the CS0-004 exam, up from 20% in CS0-003.
Which frameworks are tested?
Objective 3.1 names the Cyber Kill Chain, the Diamond Model of Intrusion Analysis and MITRE ATT&CK.
What is the difference between the Diamond Model and MITRE ATT&CK?
The Diamond Model analyzes relationships between adversary, capability, infrastructure and victim. MITRE ATT&CK catalogs specific tactics and techniques that adversaries use.
When can a system be released from isolation?
After remediation is complete and verified, persistence is removed, and the original entry point has been closed.
What is legal hold?
A requirement to preserve data relevant to litigation or investigation. It overrides normal retention schedules until it is released.
Why is root cause analysis emphasized?
Removing malware fixes one incident. Finding and correcting the root cause prevents the next one.
How does Domain 3 relate to Domain 4?
Domain 4 covers incident declaration, escalation, executive summaries, post-incident reports and response metrics such as mean time to detect and respond.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Systems Security Certified Practitioner Same subject: Domain 4: Incident Response and Recovery (14%)
- CISM (Certified Information Security Manager) Same subject: Domain 4: Incident Management (30%)
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 3 knowledge
You have covered attack frameworks, the incident response process and practical response techniques. Test whether you can sequence response actions and choose the right framework under exam conditions.