CompTIA Cybersecurity Analyst+ (CySA+) Flashcards

Security Operations; Vulnerability Management; Incident Response and Management; and Reporting and Communication.

To collect, process, and analyze data about adversary capabilities, infrastructure, and intent so defenders can proactively adjust controls and detection rather than react blindly.

A sequential model of attacker stages — reconnaissance, weaponization, delivery, exploitation, installation, command and control, and actions on objectives — used to identify where defenses can interrupt an attack.

ATT&CK is a matrix of real-world adversary tactics and techniques organized by objective (not strict sequence), giving defenders granular, mappable behaviors for detection and threat modeling rather than a linear phase model.

An alert that indicates malicious or anomalous activity when none actually occurred, wasting analyst time and potentially causing alert fatigue.

A real threat or malicious event that fails to trigger an alert; it's dangerous because the attack goes undetected and unaddressed.

A Security Information and Event Management platform aggregates, normalizes, and correlates log data from many sources to enable centralized detection, alerting, and investigation.

Security Orchestration, Automation, and Response tools automate repetitive investigation and remediation steps (playbooks) and orchestrate actions across multiple security tools, reducing analyst workload and response time.

A vulnerability scan is an automated, non-intrusive process that identifies known weaknesses; a penetration test actively exploits weaknesses to demonstrate real-world impact, typically performed manually or semi-manually.

The Common Vulnerability Scoring System provides a standardized numeric score (0-10) reflecting a vulnerability's severity based on exploitability and impact metrics, helping prioritize remediation.

A CVE (Common Vulnerabilities and Exposures) identifies a specific, publicly disclosed vulnerability instance; a CWE (Common Weakness Enumeration) categorizes the underlying type of software weakness (e.g., buffer overflow) that can lead to vulnerabilities.

Credentialed scans authenticate to the target to inspect it from the inside for deeper, more accurate results; non-credentialed scans probe from the outside without login access, similar to what an external attacker would see.

Risk is generally understood as a function of threat, vulnerability, and impact (or likelihood x impact) — the potential for loss when a threat exploits a vulnerability affecting an asset.

An alternative safeguard used when the primary or recommended control cannot be implemented, providing similar risk reduction through other means.

Preparation; Detection and Analysis; Containment, Eradication, and Recovery; and Post-Incident Activity (lessons learned).

Containment limits the spread/impact of an incident; eradication removes the root cause (malware, backdoors, compromised accounts); recovery restores affected systems to normal, verified-clean operation.

Documented, unbroken record of who collected, handled, and had access to evidence, ensuring its integrity and admissibility for legal or disciplinary proceedings.

A prioritized sequence for collecting digital evidence starting with the most volatile (CPU registers, cache, RAM) and ending with the least volatile (disk, backups, documentation), to avoid losing evidence during acquisition.

A directive to preserve all potentially relevant data and evidence because litigation, investigation, or regulatory action is anticipated, preventing normal deletion or overwriting.

An IOC is forensic evidence that a compromise already happened (e.g., a malicious hash or IP); an IOA reflects the attacker's intent or behavior in progress, enabling detection before the compromise completes.

A predefined, step-by-step procedure for responding to a specific type of incident (e.g., ransomware, phishing) that ensures consistent, repeatable, and efficient handling.

Qualitative assessment ranks risks using descriptive scales (low/medium/high); quantitative assessment assigns numeric/monetary values (e.g., using ALE, SLE, ARO) to express risk in financial terms.

Single Loss Expectancy (cost of one incident), Annualized Rate of Occurrence (expected frequency per year), and Annualized Loss Expectancy (SLE x ARO), used to estimate yearly financial risk exposure.

A proactive, analyst-driven search through networks and systems to detect threats that have evaded existing automated security controls, often based on hypotheses derived from threat intelligence.

An Intrusion Detection System passively monitors and alerts on suspicious traffic without blocking it; an Intrusion Prevention System sits inline and can actively block or drop malicious traffic in real time.

User and Entity Behavior Analytics establishes behavioral baselines for users and devices and flags anomalies (e.g., unusual login times, data access patterns) that may indicate compromised credentials or insider threats.

Dividing a network into isolated zones limits an attacker's ability to move laterally and contains the blast radius of a compromise to a smaller portion of the environment.

An inventory listing all components, libraries, and dependencies within a piece of software, used to identify supply-chain risk and quickly determine exposure when a component vulnerability is disclosed.

Continuously discovering, inventorying, and reducing all points (assets, services, exposed interfaces) where an attacker could potentially gain entry to an environment.

Traditional antivirus primarily relies on signature matching to block known malware; Endpoint Detection and Response continuously monitors endpoint behavior, enables investigation, and supports active response actions like isolation.