CompTIA CySA+ CS0-003 - All Domains Security Operations Vulnerability Management IR

Brute force on admin after hours → disable account, block source IP, check auth logs for success before lockout, force MFA reset.

Containment before eradication — don't leap to reimage if you still need forensic timeline from SIEM.

Compliance scans (PCI, HIPAA) vs credentialed vuln scan — authenticated finds missing patches inside host.

Agent-based vs agentless scanning — agents see installed software versions accurately.

Exploit available in wild bumps priority over CVSS alone. CISA KEV catalog is real-world cheat sheet.

Critical vuln on DMZ web server — patch window vs compensating WAF rule vs asset isolation. Risk-based prioritization.

Phishing triage: sandbox attachment, check headers, search O365 for same subject across users, pull IOCs to block.

User-reported phish button integrations help — still validate before mass delete legit mail.

Threat intelligence feeds: STIX/TAXII, sharing ISACs. Strategic vs operational vs tactical intel — match to audience.

Enrich SIEM alert with TI hash reputation before closing as benign.

False positive tuning: adjust threshold, enrich with context (patch level, asset owner), don't blanket disable rule.

SOAR playbooks need human approval for destructive actions — isolate host yes, delete mailbox no without review.

Forensics order: capture volatile (RAM, connections) then disk. Chain of custody documentation for legal.

Order of volatility: cache → RAM → disk → remote logs → archival tape.

Threat hunting = hypothesis-driven search, not waiting for alerts. Look for LOLBins (PowerShell, wmic) baselined against normal.

IOC vs TTP — behaviors persist when attackers rotate hashes. ATT&CK mapping helps structure hunts.

Lessons learned / post-incident review: what detection failed, what playbook worked, update runbooks and detection rules.

CySA is analyst not manager — focus on technical remediation and metrics (MTTD/MTTR), not budget slides.