CompTIA CySA+ · CS0-004
CySA+ Flashcards
Memorize threat detection and analyst concepts fast. Flip through 10 real cards from our 300+ card CySA+ deck.
10 CySA+ terms to know
- IOC
- Forensic artifact suggesting compromise, IPs, hashes, domains, registry keys, behavioral patterns. Shared via STIX/TAXII for collective defense. Higher fidelity at the behavioral layer.
- SOAR
- Platform automating SOC workflows via playbooks integrating SIEM, ticketing, EDR, threat intel. Reduces analyst toil. Examples: Splunk SOAR, Palo Alto XSOAR, Tines.
- EDR
- Endpoint security platform combining real-time monitoring, behavioral detection, and response. Records process, file, registry, network activity. Examples: CrowdStrike, SentinelOne, Defender for Endpoint.
- CVSS
- Standard for rating vulnerability severity (0.0-10.0) using base, temporal (called threat in v4.0), and environmental metrics; v4.0 also adds supplemental metrics. Drives patch prioritization. CVSS v3.1 and v4.0 are current.
- MTTD
- Average time between an incident's start and SOC detection. Key SOC metric, shorter MTTD limits attacker dwell time. Improved via better telemetry, detection engineering, and tuning.
- TTP
- Behavioral patterns of threat actors used for profiling and detection. ATT&CK organizes the TTP universe. Higher-fidelity than IOCs (which are easily changed).
- UEBA
- Detection technique baselining user and entity activity, alerting on anomalies (unusual login times, mass downloads, lateral movement). Powered by ML in modern SIEMs.
- DLP
- Tools and policies preventing sensitive data exfiltration. Inspect content at endpoints, network egress, cloud apps. Pattern-match PII, credit cards, classifications to enforce blocks/alerts.
- PAM
- Controls for privileged accounts: vaulting, session recording, just-in-time access, credential rotation. Examples: CyberArk, Delinea, BeyondTrust.
- STIX
- OASIS standard for representing cyber threat intelligence (indicators, observables, threat actors, TTPs). Paired with TAXII for transport.
What's in the CySA+ deck
CySA+ requires deep familiarity with threat intelligence frameworks, SIEM tools, vulnerability management workflows, and incident response processes. Our flashcard decks target the analyst-level knowledge that separates passing from failing CS0-004.
Key Terms & Acronyms
IOC, IOA, TTP, SIEM, SOAR, XDR, EDR, and all analyst acronyms
Threat Intelligence
MITRE ATT&CK, threat hunting, intelligence feeds, and IOC analysis
Vulnerability Management
CVSS scoring, scan types, remediation prioritization, and patch management
Incident Response
IR phases, containment strategies, forensic preservation, and chain of custody
Analyst Terminology
CySA+ is heavy on terminology. Our cards drill the exact terms and definitions the exam tests: MITRE ATT&CK tactics, SIEM alert types, and more.
Framework Focus
Dedicated cards for MITRE ATT&CK, the Diamond Model, and the Cyber Kill Chain, the attack methodology frameworks named in the CS0-004 objectives.
Tool Recognition
Know what Wireshark, Nessus, Splunk, and other analyst tools do without needing to operate them, exactly what the exam tests.
Scenario Prep
Scenario-style cards prepare you for situational questions, given these indicators, what type of attack is this?
Frequently asked questions
- Is CySA+ harder than Security+?
- CySA+ is more applied and analytical. It assumes Security+ knowledge and tests how to actually USE security tools and respond to real threats. Flashcards help with the heavy terminology load.
- Do I need to know specific SIEM tools for CySA+?
- You need to understand SIEM concepts and how to interpret logs/alerts, not operate specific products. Our flashcards focus on conceptual knowledge the exam actually tests.
- How important is MITRE ATT&CK for CySA+?
- Very important. CySA+ CS0-004 has significant MITRE ATT&CK coverage. Our dedicated threat intelligence deck covers tactics, techniques, and how to map indicators to the framework.
- How long to prepare for CySA+ with flashcards?
- 15-20 minutes of flashcard review daily combined with practice questions. Most candidates need 6-10 weeks total. Flashcards work best for the terminology-heavy domains 1 and 2.
Practice CySA+ PBQs
Performance-based questions (PBQs) are the hands-on simulations on the real exam. Practice them in our PBQ labs.
More CySA+ resources
Memorize CySA+ faster
Study the full 300+ card deck with spaced repetition, plus practice questions and mock exams.
Get started