CompTIA CySA+ Roadmap: Free Lessons and Labs by Exam Domain

Why it matters. CySA+ is the step after Security+ for people who want to work in a SOC: reading logs and alerts, finding and ranking vulnerabilities, handling incidents and reporting on all of it. The current version, V4 (exam code CS0-004), launched on June 23, 2026.

What V4 covers

Domain	Weight	Our coverage today
1. Security Operations	34%	Strong: SIEM, packet capture, Zeek, YARA, threat intel (MISP), log analysis and endpoint alerts. Thin on Windows event logs and Sysmon
2. Vulnerability Management	26%	Good on scanning and prioritizing. Thin on web app scanners, cloud and IaC tools, and SAST/SCA
3. Incident Response and Management	24%	The process is covered. Thin on hands-on response: evidence, containment, playbooks, tabletop exercises
4. Reporting and Communication	16%	Thin. Metrics and honest reporting only so far

Up to 85 questions (multiple choice plus hands-on performance-based tasks) in 165 minutes; the passing score is 750 on a scale of 100 to 900. Check CompTIA’s official exam objectives before you book.

Not there yet? CySA+ assumes Security+-level knowledge. Start with the Security+ roadmap and the Network+ roadmap if packets, ports and logs still feel new.

Domain 1: Security Operations (34% of the exam)

1.1 System and network architecture

• NTP and time sync explained — why log timestamps only line up when every clock agrees
• Syslog and SNMP monitoring lab — build a log server and see what it collects
• Who can become root? (Linux Defenders 1) — read sudoers and groups, and spot a dangerous over-grant
• Keycloak single sign-on lab — one login for two apps with OIDC, SAML and MFA
• Find leaked secrets in your repos — pull an API key out of git history before an attacker does
• Rootless containers (Linux Defenders 11) — why the docker group is an admin group, and rootless containers
• Cloud networking and SDN explained — VPCs, security groups and shared responsibility

1.2 Indicators of malicious activity

• Rogue services (Linux Defenders 2) — find a persistence service you didn’t start
• Scheduled-job backdoors (Linux Defenders 3) — plant two backdoors in cron and systemd timers, then find them
• File permission audit (Linux Defenders 7) — catch SUID binaries, world-writable files and changed files
• Spot a man-in-the-middle — pin your gateway’s MAC address and see an ARP spoof show up
• Modern identity attacks — MFA fatigue, token theft and password spraying, and what each looks like
• Social engineering and fraud — BEC, deepfake voice and QR phishing
• Is this link safe? — read a link right to left and catch lookalike domains

1.3 Tools: packets

• Read your first packet capture (Wireshark) — watch DNS and plain HTTP cross the wire, then the same page over HTTPS
• Diagnose DNS in Wireshark — diagnose DNS problems from a capture
• tcpdump cheat sheet — the filters you actually use, plus saving and reading pcaps
• Suricata IDS lab — write rules, catch a scan, tune a noisy alert, then block
• Find C2 beaconing with Zeek — capture a simulated beacon, read Zeek logs and catch it by its timing

1.3 Tools: SIEM, logs and endpoints

• Set up Splunk Free with Docker — install Splunk Free locally in one Docker command
• Splunk lab for beginners (Zeek logs) — find an SSH brute force and a DNS false positive in real Zeek logs
• Hunt failed logins in SSH logs with Splunk — turn failed SSH logins into answers
• Parse and query HTTP logs in Splunk — your first web-log hunt
• SPL cheat sheet — the Splunk searches a SOC analyst actually runs
• Which SIEM to learn — Splunk, Sentinel, Wazuh, Elastic and more compared
• Wazuh lab — stand up a free SIEM and XDR
• Wazuh agent alerts — enroll an agent and read alerts like a SOC analyst
• Linux log triage — first-response triage of your own Linux box
• Make sense of giant logs — find one outage in 117,000 log lines and write the story
• auditd (Linux Defenders 12) — who did what as root, from audit logs
• journalctl cheat sheet — filter Linux logs by time, service and severity

1.3 Tools: domains, email and files

• Check a domain with WHOIS and RDAP — check who registered a domain before you trust it
• Read email headers and report phishing — read the five header lines that matter
• SPF, DKIM and DMARC explained — the three DNS records that stop spoofed senders
• FLARE-VM file triage — safe first look at a suspicious file
• YARA rules lab — write, tune and test rules that find files by strings, bytes, entropy and hashes
• MISP threat intel lab — run a threat-intel platform, pull free feeds, look up IoCs and export STIX for your SIEM
• Malware analysis sandboxes cheat sheet — VirusTotal, Joe Sandbox, ANY.RUN and CyberChef, hash first

1.4 Threat intelligence and threat hunting

• OSINT and recon tools cheat sheet — passive recon with DNS, WHOIS and certificate logs
• Canary tokens — tripwires in your own files that tell you someone looked
• Home honeypot lab (OpenCanary) — a decoy that logs anything that knocks

1.5 Efficiency and process improvement

• Daily health-check script (Linux Defenders 8) — one script that baselines a box every morning

1.6 AI in security operations

• OWASP LLM Top 10 — the ten AI-app risks and the fix for each
• Prompt injection cheat sheet — direct and indirect prompt injection, and defenses that hold
• Data and model poisoning — how poisoned data and backdoors hide
• LLM misinformation and hallucinations — why AI output needs checking before you act on it
• Sensitive information disclosure in LLMs — how chatbots leak data they shouldn’t
• Catch prompt injection in your own RAG — plant canaries in a tiny local RAG and see injected instructions get caught

Forty-five links in Domain 1. Don’t open them all at once, or your progress report will read “almost done” like Steven’s backlog. Start with the SIEM labs. — Nyx

Domain 2: Vulnerability Management (26% of the exam)

2.1 Scanning methods

• Lab 01: your first scan — point nmap at a host that allows it and read the result
• Vulnerability scanning lab — scan with OpenVAS, rank with CVSS, EPSS and KEV, fix, then rescan
• OpenSCAP baseline scan — check a system against a published benchmark

2.2 Reading output from assessment tools

• Nmap cheat sheet — the flags you reach for every time
• Maltego lab for beginners — map your own domain’s attack surface
• Bug bounty starter lab (Burp Suite) — Juice Shop plus Burp Suite, on your own machine
• OWASP Juice Shop lab — find web flaws in a deliberately broken app you run
• Atomic Red Team + Wazuh — run one ATT&CK test and catch it in Wazuh

2.3 Prioritizing and mitigating

• CVE Prioritizer (CVSS + EPSS + KEV) — a free tool that ranks CVEs by CVSS, EPSS and KEV
• Is your server really patched? (PHP2Shell check) — six checks to prove a server is really patched
• Patching (Linux Defenders 6) — find waiting security updates and automate them
• Dangling DNS and subdomain takeover — find and remove an abandoned DNS record

2.4 Controls, risk and vulnerability management concepts

• Risk management explained — risk appetite, residual risk and the four responses
• Supply-chain and pipeline attacks — when a trusted update or dependency is the way in

Domain 3: Incident Response and Management (24% of the exam)

3.1 Attack methodology frameworks

• Cyber Kill Chain — the seven stages and how defenders break each link
• The Purple Bridge (ATT&CK technique to detection) — each technique, how it’s run, and the event ID that catches it

3.2 The incident response process

• Incident response explained — the phases, order of volatility and chain of custody
• The incident response lifecycle — what happens when the alert fires, start to finish

3.3 Incident response techniques

• Reading an incident like an analyst — report what you know, bound what you don’t
• Ransomware and data extortion — double extortion and the response that gets you back
• Backup and restore drill (Linux Defenders 13) — a backup you have actually restored

Two Domain 1 labs double as Domain 3 practice: Linux log triage (triage) and Make sense of giant logs (building a timeline).

Domain 4: Reporting and Communication (16% of the exam)

• SOC metrics explained — mean time to detect, acknowledge, contain and recover, and how teams game them
• Reading an incident like an analyst — write what you know, bound what you don’t: the core of every incident report
• Make sense of giant logs — ends with a short written account of an outage, the habit behind an after-action report
• Vulnerability scanning lab — ranks findings into a short fix list, the starting point for a vulnerability report

This is our thinnest domain. Report writing, risk scorecards, communication plans and the full set of SOC metrics are on the list below.

Coming next

Lessons we’re building to close the gaps above. They aren’t published yet, so there are no links.

• Write a vulnerability report — turn scan results into a risk scorecard, an action plan and an exception request (Domain 4, 4.1)
• Write an incident report — executive summary, timeline, root cause and lessons learned (Domain 4, 4.2)
• SOC metrics from your own SIEM — alert volume, false-positive rate and mean time to respond, on a dashboard (Domain 4, 4.2; Domain 1, 1.5)
• Who to tell, and when — communication plans: legal, PR, regulators, law enforcement and customers (Domain 4, 4.2; Domain 3, 3.3)
• Web app scanning with ZAP and Nikto — DAST on your own target (Domain 2, 2.2)
• Scan code, containers and cloud config — Trivy, Checkov, an SBOM and a SAST scan, all local (Domain 2, 2.2 and 2.4)
• Decode it with CyberChef — Base64, encoded PowerShell and suspicious commands (Domain 1, 1.3)
• Windows event logs and Sysmon — read EVTX for logons, new services and process creation (Domain 1, 1.2 and 1.3)
• Threat hunting with ATT&CK — Pyramid of Pain, Diamond Model and a heat map of one real group (Domains 1 and 3)
• Incident response hands-on — evidence hashing, chain of custody, isolating a host and a tabletop exercise (Domain 3, 3.3)
• CySA+ practice test — questions across all four domains, with memory hooks

Free outside resources

Good free material from other people. These links leave StashGrid.

• MITRE D3FEND — the defender’s side of ATT&CK: which countermeasure blocks or detects which technique
• Exploring APT campaigns (BushidoUK) — deeper digs into publicly reported APT campaigns; last updated 2022, still useful for practicing TTP mapping
• What is threat intelligence? (CrowdStrike) — strategic, operational and tactical intel, explained by a vendor
• Indicators of compromise explained (Splunk) — what counts as an IOC and how teams use them
• IBM X-Force — IBM’s threat research team, home of its yearly threat intelligence report

Videos

• Splunk SIEM crash course (Rajneesh Gupta) — a SOC-focused tour of Splunk to pair with our Splunk labs
• YARA crash course (Rajneesh Gupta) — how YARA rules are built, before you write your own
• What is MITRE ATT&CK? (Rajneesh Gupta) — the framework, and how it relates to the kill chain
• Mapping APT TTPs with ATT&CK Navigator (HackerSploit) — build a heat map for one threat group
• Find C2 activity with Zeek (Corelight) — command-and-control hunting from network logs
• Detect lateral movement with Suricata (OISF) — IDS rules for movement inside a Windows network
• Detect APTs from logs, alerts and behavior (Immersive) — turning TTPs into things you can spot
• Ingesting TAXII feeds (StrikeReady) — a short vendor demo of pulling shared indicators in automatically

Study games

Short, free games that drill the same things the exam asks, a different way. Best scores stay on your device.

• Log Hunt — spot the attack in short logs, like the hands-on exam questions
• Put It In Order — OSI, incident response phases, order of volatility, Kill Chain
• Flashcards — acronyms with spaced repetition
• Mnemonic Lab — memory phrases for every ordered list (Please Do Not Throw Sausage Pizza Away)
• Port Match — timed rounds matching ports to protocols
• PBQ simulator — five exam-style tasks: firewall rules, log evidence, vulnerability priority, control placement, subnetting
• Incident timeline lab — five logs, one incident, one timeline (PBQ practice)

Test yourself

A CySA+ practice test is on the way. Until then, the free Security+ practice test checks the Security Operations basics CySA+ builds on.

More free study

Free cybersecurity training (courses and videos) and free practice labs.

Roadmap, written by StashGrid with AI help. Domain names, weights, objective titles and exam facts from CompTIA’s CySA+ V4 page and the CS0-004 exam objectives (document version 2.0), checked on Nov 5, 2026. Labs that use attack tools run only on machines you own, in an isolated lab. StashGrid isn’t affiliated with CompTIA. Spotted an error? Tell us.