Book Image

CompTIA CySA+ Study Guide: Exam CS0-002

By : Mike Chapple, David Seidl
Book Image

CompTIA CySA+ Study Guide: Exam CS0-002

By: Mike Chapple, David Seidl

Overview of this book

The Cybersecurity Analyst (CySA+) certification applies behavioral analytics to improve the overall state of IT security. CompTIA CySA+ meets the ISO 17024 standard and is approved by the U.S. Department of Defense to fulfill Directive 8570.01-M requirements. It is compliant with government regulations under the Federal Information Security Management Act (FISMA). More than just test prep, this book helps you to learn skills to demonstrate your command of all domains and topics covered by the CySA+ exam. The CompTIA CySA+ Study Guide provides complete coverage of all exam objectives for the new CySA+ certification. The CySA+ certification validates a candidate's skills to configure and use threat detection tools, perform data analysis, and identify vulnerabilities with a goal of securing and protecting systems of organizations. You'll study concepts with real-world examples drawn from experts, and hands-on labs. You'll gain insight on how to create your own cybersecurity toolkit. The end-of-chapter review questions will help you reinforce your knowledge. By the end of the book, you’ll have the skills and confidence you need to think and respond like a seasoned professional.

Related Content you might be interested in

Current Title:

Small book image
CompTIA CySA+ Study Guide: Exam CS0-002
Mike Chapple | David Seidl
Apr, 2017 | 560 pages
No titles found
Table of Contents (23 chapters)
Free Chapter
1
Acknowledgments
Acknowledgments
2
About the Authors
About the Authors
3
Introduction
Introduction
What Does This Book Cover?
Setting Up a Kali and Metasploitable Learning Environment
Setting Up Your Environment
Objectives Map for CompTIA Cybersecurity Analyst (CySA+) Exam CS0-001
Objectives Map
4
Assessment Test
Assessment Test
5
Answer to the Assessment Test
Answer to the Assessment Test
6
Chapter 1 Defending Against Cybersecurity Threats
Chapter 1 Defending Against Cybersecurity Threats
Cybersecurity Objectives
Evaluating Security Risks
Building a Secure Network
Secure Endpoint Management
Penetration Testing
Reverse Engineering
Summary
Exam Essentials
Lab Exercises
Review Questions
7
Chapter 2 Reconnaissance and Intelligence Gathering
Chapter 2 Reconnaissance and Intelligence Gathering
Footprinting
Passive Footprinting
Gathering Organizational Intelligence
Detecting, Preventing, and Responding to Reconnaissance
Summary
Exam Essentials
Lab Exercises
Review Questions
8
Chapter 3 Designing a Vulnerability Management Program
Chapter 3 Designing a Vulnerability Management Program
Identifying Vulnerability Management Requirements
Configuring and Executing Vulnerability Scans
Developing a Remediation Workflow
Overcoming Barriers to Vulnerability Scanning
Summary
Exam Essentials
Lab Exercises
Review Questions
9
Chapter 4 Analyzing Vulnerability Scans
Chapter 4 Analyzing Vulnerability Scans
Reviewing and Interpreting Scan Reports
Validating Scan Results
Common Vulnerabilities
Summary
Exam Essentials
Lab Exercises
Review Questions
10
Chapter 5 Building an Incident Response Program
Chapter 5 Building an Incident Response Program
Security Incidents
Phases of Incident Response
Building the Foundation for Incident Response
Creating an Incident Response Team
Coordination and Information Sharing
Classifying Incidents
Summary
Exam Essentials
Lab Exercises
Review Questions
11
Chapter 6 Analyzing Symptoms for Incident Response
Chapter 6 Analyzing Symptoms for Incident Response
Analyzing Network Events
Handling Network Probes and Attacks
Investigating Host Issues
Investigating Service and Application Issues
Summary
Exam Essentials
Lab Exercises
Review Questions
12
Chapter 7 Performing Forensic Analysis
Chapter 7 Performing Forensic Analysis
Building a Forensics Capability
Understanding Forensic Software
Conducting a Forensic Investigation
Forensic Investigation: An Example
Summary
Exam Essentials
Lab Exercises
Review Questions
13
Chapter 8 Recovery and Post-Incident Response
Chapter 8 Recovery and Post-Incident Response
Containing the Damage
Incident Eradication and Recovery
Wrapping Up the Response
Summary
Exam Essentials
Lab Exercises
Review Questions
14
Chapter 9 Policy and Compliance
Chapter 9 Policy and Compliance
Understanding Policy Documents
Complying with Laws and Regulations
Adopting a Standard Framework
Implementing Policy-Based Controls
Security Control Verification and Quality Control
Summary
Exam Essentials
Lab Exercises
Review Questions
15
Chapter 10 Defense-in-Depth Security Architectures
Chapter 10 Defense-in-Depth Security Architectures
Understanding Defense in Depth
Implementing Defense in Depth
Analyzing Security Architecture
Summary
Exam Essentials
Lab Exercises
Review Questions
16
Chapter 11 Identity and Access Management Security
Chapter 11 Identity and Access Management Security
Understanding Identity
Threats to Identity and Access
Identity as a Security Layer
Understanding Federated Identity and Single Sign-On
Review Questions
17
Chapter 12 Software Development Security
Chapter 12 Software Development Security
Understanding the Software Development Life Cycle
Designing and Coding for Security
Software Security Testing
Summary
Exam Essentials
Lab Exercises
Review Questions
18
Chapter 13 Cybersecurity Toolkit
Chapter 13 Cybersecurity Toolkit
Host Security Tools
Monitoring and Analysis Tools
Scanning and Testing Tools
Network Security Tools
Web Application Security Tools
Forensics Tools
Summary
19
Index
Index
20
Advert
Advert
21
EULA
EULA
Appendix A Answers to the Review Questions
Appendix A Answers to the Review Questions
Chapter 1: Defending Against Cybersecurity Threats
Chapter 2: Reconnaissance and Intelligence Gathering
Chapter 3: Designing a Vulnerability Management Program
Chapter 4: Analyzing Vulnerability Scans
Chapter 5: Building an Incident Response Program
Chapter 6: Analyzing Symptoms for Incident Response
Chapter 7: Performing Forensic Analysis
Chapter 8: Recovery and Post-Incident Response
Chapter 9: Policy and Compliance
Chapter 10: Defense-in-Depth Security Architectures
Chapter 11: Identity and Access Management Security
Chapter 12: Software Development Security
Appendix B Answers to the Lab Exercises
Appendix B Answers to the Lab Exercises
Chapter 1: Defending Against Cybersecurity Threats
Chapter 2: Reconnaissance and Intelligence Gathering
Chapter 4: Analyzing Vulnerability Scans
Chapter 5: Building an Incident Response Program
Chapter 6: Analyzing Symptoms for Incident Response
Chapter 7: Performing Forensic Analysis
Chapter 8: Recovery and Post-Incident Response
Chapter 9: Policy and Compliance
Chapter 10: Defense-in-Depth Security Architectures
Chapter 11: Identity and Access Management Security
Chapter 12: Software Development Security

Chapter 8: Recovery and Post-Incident Response

  1. 1. A. The containment, eradication, and recovery phase of incident response includes active undertakings designed to minimize the damage caused by the incident and restore normal operations as quickly as possible.

  2. 2. C. NIST recommends using six criteria to evaluate a containment strategy: the potential damage to resources, the need for evidence preservation, service availability, time and resources required (including cost), effectiveness of the strategy, and duration of the solution.

  3. 3. C. In a segmentation approach, the suspect system is placed on a separate network where it has very limited access to other networked resources.

  4. 4. B. In the isolation strategy, the quarantine network is directly connected to the Internet or restricted severely by firewall rules so that the attacker may continue to control it but not gain access to any other networked resources.

  5. 5. D. In the removal approach, Alice keeps the systems running...

Previous Section
End of Section
Next Section