Overview
Domain 1 covers what a level-2 SOC analyst does every shift. It starts with architecture concepts that shape detection: logging (ingestion, integrity, time synchronization, retention), operating system internals, cloud-native, virtualized and containerized systems, APIs, device management, Zero Trust and SASE, identity including PAM and secrets management, encryption, data protection, and OT, ICS and SCADA. It covers analyzing indicators across network, host, application, cloud, identity, email and social engineering. It covers tools such as CyberChef, Wireshark, Zeek, SIEM, EDR and XDR, threat-intelligence platforms, reputation services, YARA and sandboxes, along with file formats and scripting. It then covers threat intelligence and hunting, efficiency through playbooks, SOAR and tuning, and, new in CS0-004, AI in security operations.
The domain feeds the rest of the exam. What you detect here is prioritized in Domain 2, handled in Domain 3 and reported in Domain 4.
How it's tested
Expect scenario questions and performance-based items that show logs, packet captures, command lines or alert details. You are asked what activity is occurring, which tool or technique would BEST confirm it, or what the analyst should do next. Reading artifacts carefully matters more than memorizing definitions.
-
Read the artifact
A log excerpt, command line, email header or packet summary is shown, and you must identify the malicious indicator in it.
-
Right tool for the question
An analysis need is described, such as decoding a string, checking a domain, testing a file or matching a pattern, and you must choose the appropriate tool.
-
Intelligence value
Indicators or intelligence sources are compared, and you must judge which is more durable, relevant or actionable.
An EDR alert shows certutil.exe downloading a file from an unfamiliar domain and then a PowerShell process launched with a long Base64-encoded argument. Asked what this indicates, set aside 'normal admin activity' even though both tools are legitimate. Legitimate binaries used to fetch and run encoded payloads are classic living-off-the-land behavior. The next step is to decode the argument, for example in CyberChef, and check the domain's reputation.
Objectives 6
Official objectives from the CompTIA outline, in outline order.
1.1 Explain concepts related to system and network architecture in security operations.Logging, OS, infrastructure, devices, network architecture, IAM, encryption, data protection and critical infrastructure.
- What it means
- This objective covers the architecture an analyst monitors: how logs are ingested, configured, protected, time-synchronized and retained; OS hardening, critical files and processes; cloud-native, virtualized and containerized systems and APIs; mobile and endpoint management; Zero Trust network access, secure access service edge (SASE) and hybrid cloud; IAM including PAM, authentication methods and secrets management; encryption and data protection; and OT, ICS and SCADA environments.
- What to understand
- Detection quality depends on architecture. Missing logs, unsynchronized clocks or logs an attacker can edit undermine every investigation. Knowing which processes and files are normal on a system lets you spot what is not. OT and ICS environments put availability and safety first, so aggressive scanning or patching can be dangerous there.
- How it shows up
- Questions describe a visibility gap or architecture choice and ask what limits detection, or which control best supports monitoring, such as centralized logging or time synchronization.
- Common confusion
- Assuming more log sources automatically mean better detection. Without parsing, integrity protection and tuning, extra data just adds noise and cost.
1.2 Given a scenario, analyze indicators of potential malicious activity.Network, host, application, cloud, identity, social engineering and email indicators.
- What it means
- Indicators include network signs such as rogue devices, enumeration, anomalous traffic and activity on unexpected ports; host signs such as unusual resource use, unauthorized software, rogue processes, LOLBins and scripts, file system changes, data exfiltration and unauthorized configuration; application signs such as service disruption; cloud signs such as resource compromise; identity signs such as account compromise and impossible travel; and social engineering and email attacks such as typosquatting, URL shorteners and business email compromise (BEC).
- What to understand
- Single indicators are rarely conclusive. Correlating several, such as a login from a new country followed by mailbox rule creation and outbound transfers, builds a reliable picture. Living-off-the-land activity uses trusted system tools, so judge it by context and arguments rather than the tool's name.
- How it shows up
- A log, alert or narrative is presented and you must identify the most likely malicious activity or the strongest indicator.
- Common confusion
- Dismissing activity because it uses legitimate tools. Attackers deliberately use built-in binaries to blend in.
1.3 Given a scenario, use tools to determine malicious activity.Decoding, packet and log analysis, threat intel platforms, EDR, reputation, file analysis, sandboxing, patterns, email and UEBA, plus file formats and scripts.
- What it means
- The tools listed include CyberChef for decoding, Wireshark, tcpdump, Snort, Suricata and Zeek for network analysis, SIEM for logs, OTX, MISP and OpenCTI for threat intelligence, EDR, XDR and MDM for endpoints, WHOIS, AbuseIPDB and GeoIP for reputation, strings, VirusTotal and YARA for files, Joe Sandbox and Cuckoo for detonation, regular expressions, MXToolbox for email, and UEBA. Analysts also read JSON, XML, YAML and EVTX files and Python, PowerShell and shell scripts.
- What to understand
- Choose tools by the question you need answered. Decode with CyberChef, inspect traffic with Wireshark or Zeek logs, match malware families with YARA, and detonate unknown files in a sandbox. Uploading a file to a public service like VirusTotal can expose sensitive data or alert an attacker, so checking a hash first is often safer.
- How it shows up
- A task is described, such as an encoded string, a suspicious attachment or an unknown domain, and you must choose the BEST tool, or interpret a tool's output.
- Common confusion
- Uploading internal or sensitive files to public analysis sites. Hash lookups or a private sandbox are safer first steps.
1.4 Explain threat intelligence and threat-hunting concepts.Threat actors, TTPs, confidence, sources, IoCs, threat modeling, threat mapping and deception.
- What it means
- This objective covers threat actors such as APTs and insiders, tactics, techniques and procedures (TTPs) with heat maps, the Pyramid of Pain, MITRE ATT&CK and attribution, how timeliness, relevance and accuracy affect confidence, collection through OSINT, closed sources and sharing, the collection, analysis and use of atomic and behavioral IoCs, STRIDE threat modeling, threat mapping, and cyber deception.
- What to understand
- The Pyramid of Pain ranks indicators by how much it hurts an attacker when you detect them: hashes and IP addresses are trivial to change, while TTPs are hardest. Behavioral detections based on TTPs therefore last longer than atomic IoCs. Intelligence is only valuable if it is timely, relevant to your environment and accurate. Threat hunting is proactive and starts from a hypothesis, not from an alert.
- How it shows up
- Questions ask which indicator type is most durable, how to judge an intelligence source, or what distinguishes threat hunting from alert triage.
- Common confusion
- Treating more IoCs as better intelligence. Stale or irrelevant indicators create noise and false confidence.
1.5 Explain the importance of efficiency and process improvement in security operations.Standardized processes, automation and orchestration, data enrichment and tool integration.
- What it means
- Efficiency comes from standardizing processes through team coordination and playbooks or runbooks, streamlining operations with automation and orchestration such as SOAR and infrastructure as code, enriching data, tuning rules and alerts, building dashboards, and integrating tools through APIs, webhooks and plug-ins.
- What to understand
- Automation is best applied to repeatable, well-understood tasks such as enrichment and ticket creation. Tuning reduces false positives so analysts can focus. Playbooks make responses consistent across shifts. High-impact automated actions still need guardrails and human approval.
- How it shows up
- A SOC is overwhelmed or inconsistent, and you must choose the improvement that BEST addresses it, such as automating enrichment, tuning rules or writing playbooks.
- Common confusion
- Automating a broken process. Standardize and document first, then automate.
1.6 Summarize concepts related to the use of AI in security operations.AI risks, governance and use cases.
- What it means
- This new objective covers AI risks such as hallucinations, data exposure, model poisoning and malicious prompts, governance through legal and regulatory compliance and AI usage policies, and use cases such as comparing artifacts, analyzing logs, creating documents, supporting investigations, correlating events and automating workflows.
- What to understand
- AI can speed up analysis but can produce confident, wrong answers, so outputs must be verified before acting. Pasting sensitive logs or incident data into unapproved AI services risks data exposure. Usage policies define which tools are approved and what data may be shared with them.
- How it shows up
- Questions describe an analyst using an AI tool and ask for the main risk or the right governance step, such as verifying output or using an approved, private tool.
- Common confusion
- Treating AI output as authoritative evidence. It is an aid to analysis that needs validation.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Living off the land (LOLBins)
Attackers using legitimate system binaries and scripts, such as PowerShell or certutil, for malicious purposes.
- Remember
- Judge by context and arguments, not by the tool's name.
- Tested as
- Host indicator questions.
- Trap
- Dismissing activity because the binary is signed and built-in.
-
Impossible travel
Logins from locations too far apart to reach in the time between them.
- Remember
- Check VPNs and proxies before concluding compromise.
- Tested as
- Identity indicator questions.
- Trap
- Ignoring legitimate explanations such as corporate VPN egress.
-
Business email compromise (BEC)
Fraud using compromised or spoofed business email, often to redirect payments.
- Remember
- Signs include new inbox rules, payment detail changes and lookalike domains.
- Tested as
- Email attack questions.
- Trap
- Looking only for malware when BEC usually has none.
-
Pyramid of Pain
Ranks indicators from hashes and IP addresses (easy for attackers to change) up to TTPs (hardest).
- Remember
- Detecting TTPs imposes the most cost on attackers.
- Tested as
- Indicator durability questions.
- Trap
- Valuing hash-based detection as long-lasting.
-
Atomic vs. behavioral IoCs
Atomic IoCs are single values such as an IP or hash. Behavioral IoCs describe patterns of activity.
- Remember
- Behavioral indicators survive attacker infrastructure changes.
- Tested as
- Threat intelligence questions.
- Trap
- Treating a blocked IP as lasting protection.
-
Intelligence confidence
Intelligence value depends on timeliness, relevance and accuracy.
- Remember
- Old or irrelevant intelligence wastes analyst time.
- Tested as
- Source evaluation questions.
- Trap
- Ingesting every feed without vetting.
-
Threat hunting
Proactive, hypothesis-driven searching for threats that evaded detection.
- Remember
- It starts from a hypothesis, not an alert.
- Tested as
- Hunting vs. triage questions.
- Trap
- Calling alert investigation threat hunting.
-
Zeek vs. Snort and Suricata
Zeek produces rich logs of network activity for analysis. Snort and Suricata are signature-based IDS or IPS engines.
- Remember
- Use Zeek for network metadata and hunting, Snort or Suricata for rule-based detection.
- Tested as
- Tool selection questions.
- Trap
- Treating Zeek as an inline blocking tool.
-
YARA
A rule language for identifying malware by patterns in files.
- Remember
- Used to classify and hunt for malware families.
- Tested as
- File analysis questions.
- Trap
- Confusing it with a sandbox.
-
Sandboxing
Running a suspicious file in an isolated environment to observe its behavior.
- Remember
- Some malware detects sandboxes and stays dormant.
- Tested as
- Dynamic analysis questions.
- Trap
- Treating a clean sandbox result as proof of safety.
-
SOAR
Security orchestration, automation and response tools run playbooks across integrated systems.
- Remember
- Best for repeatable tasks, with guardrails on high-impact actions.
- Tested as
- Efficiency questions.
- Trap
- Automating before the process is standardized.
-
AI risks in the SOC
Hallucinations, data exposure, model poisoning and malicious prompts.
- Remember
- Verify AI output and use only approved tools for sensitive data.
- Tested as
- New CS0-004 AI questions.
- Trap
- Pasting incident data into public AI tools.
-
OT and ICS priorities
Operational technology prioritizes safety and availability.
- Remember
- Active scanning or rapid patching can disrupt physical processes.
- Tested as
- Critical infrastructure questions.
- Trap
- Applying IT scanning practices to SCADA systems.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
Threat hunting vs. alert triage vs. threat intelligence
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Threat hunting | Proactive search for undetected threats | Starts from a hypothesis | Calling any investigation hunting |
| Alert triage | Assessing and prioritizing alerts that fired | Starts from an alert | Closing alerts without checking context |
| Threat intelligence | Information about threats, actors and indicators | Feeds hunting and detection | Ingesting it without judging relevance |
Wireshark vs. Zeek vs. Snort/Suricata vs. SIEM
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Wireshark and tcpdump | Capture and inspect individual packets | Deep packet-level detail | Using them for long-term enterprise monitoring |
| Zeek | Generates structured logs describing network activity | Metadata for hunting and analysis | Expecting it to block traffic |
| Snort and Suricata | Signature-based IDS or IPS engines | Rule-based detection or prevention | Expecting them to detect novel behavior without rules |
| SIEM | Aggregates and correlates logs from many sources | Enterprise-wide correlation and alerting | Assuming deployment alone produces good alerts |
Hash lookup vs. VirusTotal upload vs. sandbox vs. YARA
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Hash lookup | Checking whether a file's hash is already known | Reveals nothing about the file's contents | Concluding a file is safe because its hash is unknown |
| Public upload | Submitting the file to a public multi-engine service | Broad detection but the file may become visible to others | Uploading sensitive internal documents |
| Sandbox | Detonating the file in isolation to observe behavior | Shows what the file does | Trusting a quiet result from sandbox-aware malware |
| YARA | Matching files against pattern rules | Classifies and hunts for known families | Expecting it to reveal runtime behavior |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Signed means safe
- What candidates pick
- Ignore PowerShell or certutil activity because they are signed system tools.
- Why it looks right
- These tools run legitimately every day.
- Why it's wrong
- Living-off-the-land attacks rely on trusted binaries. Encoded arguments, unusual parents or downloads from unknown domains are the indicators.
Clue to watch for Look at the command-line arguments and the parent process.
-
Upload everything
- What candidates pick
- Upload a suspicious internal spreadsheet to VirusTotal for analysis.
- Why it looks right
- It quickly checks many antivirus engines.
- Why it's wrong
- Public uploads can expose sensitive content and tip off attackers. Check the hash first or use a private sandbox.
Clue to watch for The file may contain confidential or customer data.
-
Block the IP and move on
- What candidates pick
- Block the attacker's IP address as the long-term fix.
- Why it looks right
- It stops the observed traffic immediately.
- Why it's wrong
- IP addresses sit near the bottom of the Pyramid of Pain and are trivial to change. Detecting the TTPs lasts longer.
Clue to watch for The question asks for the MOST durable detection or response.
-
Impossible travel equals breach
- What candidates pick
- Disable an account immediately after an impossible-travel alert.
- Why it looks right
- Impossible travel is a well-known compromise signal.
- Why it's wrong
- Corporate VPNs, proxies and cloud egress points can create false impossible-travel alerts. Validate context first.
Clue to watch for The scenario mentions VPN use or a known egress location.
-
Automate the mess
- What candidates pick
- Deploy SOAR immediately to fix an inconsistent, overloaded SOC.
- Why it looks right
- Automation promises speed.
- Why it's wrong
- Without standardized processes and playbooks, automation repeats inconsistency faster. Standardize first.
Clue to watch for The scenario describes analysts handling the same alert differently.
-
AI as source of truth
- What candidates pick
- Act on an AI assistant's conclusion about an incident without checking it.
- Why it looks right
- The tool produced a detailed, confident summary.
- Why it's wrong
- AI can hallucinate. Outputs must be validated against evidence before action.
Clue to watch for The question asks for the main risk of using AI in analysis.
Answer framework
For any Domain 1 analysis scenario, work through these steps before answering.
- Read the artifact carefully, noting the process, parent, arguments, user, source, destination, port and time before forming any conclusion.
- Classify the indicator by type, such as network, host, identity, cloud or email, and look for correlating evidence rather than relying on one signal.
- Choose the tool that answers your specific question, such as decoding, reputation, file classification, detonation or traffic inspection.
- Judge intelligence and indicators by durability, timeliness, relevance and accuracy, preferring behavioral detections over atomic values.
- Prefer process improvements that standardize first and automate second, and verify any AI-assisted output before acting on it, and document what you decided and why.
Practice question
Want more like this? The CySA+ practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Give this domain the most study time, since it carries 34% of the exam. Start with 1.2, indicator analysis, and practice on real artifacts: Windows event logs, command lines, email headers and packet captures. The exam rewards careful reading, so build the habit of noting process, parent, arguments and destination before deciding.
Next, work through the tools in 1.3 with a simple rule for each: what question does this tool answer? Get hands-on where you can with CyberChef, Wireshark, a SIEM and a sandbox. Learn the safety point about public uploads.
Then study threat intelligence and hunting in 1.4, focusing on the Pyramid of Pain, atomic versus behavioral indicators and the difference between hunting and triage. Candidates commonly underestimate the architecture concepts in 1.1, especially logging and OT, and the new AI objective in 1.6.
Afterwards, move to Domain 3. The indicators you learn here are what start incident response, and practicing the handoff from detection to response helps with sequencing questions.
FAQ
How much of CySA+ CS0-004 is Domain 1?
Security Operations is 34% of the CS0-004 exam, the largest of the four domains.
What is new in Domain 1 for CS0-004?
The most visible addition is objective 1.6 on AI in security operations, covering AI risks, governance and use cases. Architecture topics such as SASE, secrets management and OT and ICS are also listed.
Do I need hands-on tool experience?
It helps a great deal. The exam includes performance-based questions and expects you to interpret tool output, so practicing with tools such as Wireshark, CyberChef and a SIEM is valuable.
Do I need to write scripts?
The objectives list Python, PowerShell and shell script. You should be able to read simple scripts and recognize suspicious commands, rather than write complex programs.
What is the Pyramid of Pain?
A model ranking indicators by how costly they are for attackers to change, from hash values and IP addresses at the bottom to tactics, techniques and procedures at the top.
Is CS0-003 still available?
The English CS0-003 exam remains available until 22 December 2026. CS0-004 launched on 23 June 2026 with the same four domain names but different weights.
How does Domain 1 connect to the other domains?
Detections here lead to incident handling in Domain 3, vulnerabilities found here feed Domain 2's prioritization, and both are reported under Domain 4.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Microsoft Security Operations Analyst Associate Same subject: Domain 1: Manage a security operations environment (40–45%)
- CompTIA SecurityX (CASP+) Same subject: Domain 4: Security Operations (22%)
- CISSP Same subject: Domain 7: Security Operations (13%)
- CompTIA Security+ Same subject: Domain 4: Security Operations (28%)
- Certified Cloud Security Professional Same subject: Domain 5: Cloud Security Operations (17%)
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- Certified Information Systems Auditor Study guide
Test your Domain 1 knowledge
You have covered architecture, indicators, tools, threat intelligence, SOC efficiency and AI in security operations. Test whether you can read artifacts and choose the right tool under exam conditions.