CySA+ study plan

Map every Domain 1 objective to a one-page personal note and flag gaps in logging and network telemetry coverage

Stand up a free SIEM or log-analysis lab and ingest at least three distinct log sources

Write five working correlation queries that detect brute-force authentication, port scanning, and anomalous outbound traffic

Reconstruct from memory the telemetry-to-tool mapping across flow data, packet capture, proxy logs, and DNS logs

Compare agent-based and agentless endpoint telemetry and select the right approach for three given scenarios

Build an IOC-matching workflow against a threat intel feed and assign a confidence rating to each indicator

Rank identity and access monitoring controls by detection value, including MFA anomalies, impossible travel, and privilege escalation

Walk through two SOAR playbooks and identify which manual steps are candidates for automation

Differentiate credentialed from non-credentialed scanning and justify a scan mode choice for three scenarios

Score ten sample findings with CVSS v3.1 base metrics and defend each vector string

Separate false positives, true positives, and false negatives using a supplied test data set

Map common scan outputs such as CVE identifiers, CPE strings, and configuration benchmark results to the correct vulnerability management lifecycle stage

Prioritize a 25-item finding list using a method that combines CVSS, asset criticality, and threat context

Draft remediation SLAs by severity tier and defend each timeline against business constraints

Select compensating controls that reduce residual risk when patching is not feasible

Compare scan cadence options against continuous monitoring and compliance-driven testing requirements

Classify incidents against a severity matrix and justify each escalation decision

State the evidence-handling rule that applies at each phase of the incident response lifecycle

Order volatile evidence collection correctly for a compromised workstation scenario

Differentiate containment strategies such as host isolation, network segmentation, and account disablement by blast radius

Trace a lateral-movement scenario through log data and identify the detection gaps exposed

Distinguish eradication from recovery and list the validation criteria required before returning a host to service

Map common attack techniques to the specific data sources that would reveal them

Draft a post-incident review template capturing root cause, lessons learned, and control updates

Translate technical findings into risk statements tailored to executive and technical audiences

Assign metric types such as MTTD, MTTR, and detection coverage to the audience that should receive them

Apply data-handling and disclosure rules to a breach-notification scenario

Draft a vulnerability report that includes business impact, supporting evidence, and a recommended action

Re-test every objective flagged as weak in weeks 1 through 7 and close the remaining gaps

Complete two timed full-length practice exams and trace each miss back to its root cause

Recite from memory the incident response lifecycle, the vulnerability management lifecycle, and the CVSS base metric groups

Build a one-page pre-exam reference sheet of thresholds, formulas, and acronyms