CySA+ case studies
CySA+ · Put your knowledge to work in context.
CompTIA Cybersecurity Analyst (CySA+) is an intermediate-level, vendor-neutral certification that validates the practical skills needed to detect, analyze, and respond to security threats in a security operations center. It sits on the CompTIA Cybersecurity Career Pathway between Security+ and SecurityX, and is aimed at analysts with roughly four years of hands-on experience in a SOC analyst (Level 2) or vulnerability analyst role, or three to four years of related information security experience or equivalent training. The CySA+ case studies are 5 cases and about 3,632 words.
1Impossible Travel With a Clean Endpoint
At 10:05 UTC the identity team escalates an alert: finance analyst m.chen signed in to Microsoft 365 from Lagos at 09:12 and from Chicago at 09:40, and both sessions satisfied MFA. Chen insists she has been in Chicago all week.
786 words, about 4 min2The 9.8 That Is Not First
You own vulnerability management for 1,800 hosts. A quarter-end change freeze starts in 10 days; the next patch window is 26 days out.
670 words, about 3 min3Ransomware at 08:05 on a Monday
The service desk has taken 30 tickets in 20 minutes: files renamed with a .locked extension. EDR shows vssadmin delete shadows /all /quiet executed on four file servers between 07:12 and 07:30, and one domain controller rebooted unexpectedly at 07:33.
748 words, about 4 min4Twelve Thousand Records and a Confident CEO
At 23:00 Friday you confirm an attacker accessed a customer database through SQL injection in a legacy order-status page. Scope: 12,000 customer records with names and email addresses, 300 of which also contain full SSNs and dates of birth; passwords are stored as bcrypt hashes with cost factor 12.
733 words, about 4 min5The Beacon Nobody Saw
Your SIEM has been live 90 days and produces 4,200 alerts per day for three analysts; mean time to acknowledge is 9 hours. A post-incident review of a confirmed intrusion finds the C2 beacon, HTTPS POSTs every 300 seconds to a domain registered six days earlier, was present in the proxy logs the whole time, buried among 1,100 daily alerts from one rule that fires on 'uncategorized site'.
695 words, about 3 min