Chapter 1 of 4 · CompTIA CySA+ CS0-004

Security Operations

Architecture, logs, indicators, detection tools, threat intelligence, hunting, automation and AI.

  • 10topics
  • 54 minfast track
  • 5diagrams and exhibits
  • 34%of the exam
Start with Security Architecture Concepts

Topics in this chapter

Take them in order, or jump to the one you need.

  1. 1Security Architecture ConceptsSecurity architecture for CySA+: defence in depth, segmentation, zero trust, SASE, perimeter devices and the cloud shared…Diagram7 min
  2. 2Identity and Logging PracticesIdentity concepts such as MFA, SSO, SAML, OAuth and PAM, plus logging practices like central collection, time sync and key…4 min
  3. 3Indicators of Malicious ActivityRecognise signs of malicious activity across network, host, application, cloud and identity data, from beaconing to impossible…6 min
  4. 4SIEM and EDR ToolsHow SIEM correlation and EDR endpoint telemetry help analysts find and contain malicious activity, with alert tuning and a worked…Diagram5 min
  5. 5Packet, File and Email AnalysisUse Wireshark, tcpdump, flow data, hashing, sandboxes and email header checks to judge whether traffic, files and messages are…Diagram6 min
  6. 6Threat Intelligence ConceptsThreat intelligence types, sources, IOCs versus TTPs, the intelligence cycle, STIX and TAXII, the Traffic Light Protocol and TIPs…Diagram6 min
  7. 7Threat Hunting MethodsThreat hunting for CySA+: hypothesis driven searches, triggers, data sources, methods such as IOC sweeps and baselining, and how…4 min
  8. 8Automation and Process ImprovementHow SOAR, playbooks, scripting, APIs and standard workflows make security operations faster and more consistent, and where…5 min
  9. 9AI in Security OperationsHow AI and machine learning help detect and triage threats, plus the risks of prompt injection, data leakage and poisoning, and…6 min
  10. 10Encryption TechniquesEncryption for CySA+: symmetric and asymmetric keys, hashing, digital signatures, PKI certificates, data at rest and in transit…5 min

About this chapter

What this chapter covers

Security operations is the daily work of watching systems, spotting attacks and deciding what to do about them. It is the largest domain of the CompTIA Cybersecurity Analyst (CySA+) CS0-004 exam, so the habits it teaches carry through the whole certification.

The chapter starts with the environment an analyst defends: how networks, identities and logs are set up. It then moves to recognising suspicious activity, the tools used to confirm it, the intelligence and hunting work that finds more, and finally how automation and artificial intelligence (AI) make the team faster.

At this level the focus is on reading evidence and making sound judgements. You are not expected to carry out attacks.

How the topics fit together

The pages follow the order in which an analyst meets the material.

Architecture and logswhat we defend and recordIndicatorswhat looks wrongToolsalerts, endpoint, packetsIntelligence and huntingwho and what nextAutomation and AIwork faster
  • Architecture, identity and logging explain what a normal, well built environment looks like and which records it produces.
  • Indicators describe the signs of malicious activity on networks, hosts, identities and the cloud.
  • Security Information and Event Management (SIEM), Endpoint Detection and Response (EDR) and packet, file and email analysis are the tools that confirm or dismiss a suspicion.
  • Threat intelligence and hunting use outside knowledge and proactive searches to find activity that alerts missed.
  • Automation and AI reduce routine work, and bring their own risks.
Exam tip

Exam questions often give a log excerpt or a short scenario and ask for the most likely meaning or the best next step. Practise explaining why a pattern is suspicious, not only naming it.

How to use these pages

Each topic page has the same shape, so you can skim for what you need.

  • What it is: the idea in plain words.
  • How it works: the mechanism, with diagrams, tables and examples.
  • What to remember for the exam: the facts to memorise.
  • Common mistakes: the classic traps.
  • Check yourself: three questions to test your understanding.

Read the pages in order the first time. Later, return to the "What to remember" lists for revision, and cover the answers in "Check yourself" to test recall.

Ready for more practice?

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.