CompTIA CySA+ flashcards

3 decks · 213 cards · built into Willys · free samples below

Written against: Exam CS0-003 objectives. Updated 2026-10-10.

What's in it

Every deck follows the course outline, with tags you can study or suspend topic by topic. Open a deck to study its free sample right here.

Learn · 2 decks · 153 cards

Concepts, mechanisms and the questions a course or exam asks about them.

Security Operations and Vulnerability Management CS0-003 domains 1 and 2 plus objective 3.1, from the analyst's chair: logging and architecture, indicators of malicious activity, Wireshark, nmap and email-header analysis, threat intelligence and hunting, the Kill Chain, ATT&CK and the Diamond Model, scanning, CVSS, prioritisation and mitigations. 10 free · 80 cards in the app Incident Response and Reporting CS0-003 domains 3 and 4: IR preparation and playbooks, detection and scoping, forensic acquisition and volatility, containment, eradication and recovery, root cause analysis and lessons learned, vulnerability and incident reporting, remediation inhibitors and metrics such as MTTD and MTTR. 10 free · 73 cards in the app

Practice · 1 deck · 60 questions

Multiple-choice practice questions, one best answer each, with the reasoning.

Practice Questions CS0-003 multiple-choice practice questions, one best answer each, on log and indicator analysis, threat hunting, scanning and CVSS prioritisation, incident response, forensics and reporting. 6 free · 60 questions in the app

Study guide

Topics covered

The decks follow the order of the course outline. Numbers are cards per topic.

Security Operations 55
- Architecture and Logging 10
- Indicators of Malicious Activity 14
- Analysis Tools and Techniques 16
- Threat Intelligence and Hunting 10
- Automation and Efficiency 5
Vulnerability Management 51
- Scanning Methods 11
- Assessment Tools 7
- CVSS and Prioritisation 12
- Vulnerability Classes and Controls 11
- Response and Attack Surface 10
Incident Response and Management 71
- Attack Frameworks 10
- Preparation 11
- Detection and Analysis 12
- Evidence and Forensics 15
- Containment Eradication and Recovery 14
- Post-Incident Activity 9
Reporting and Communication 36
- Vulnerability Reporting 8
- Remediation Inhibitors 7
- Incident Reporting and Communication 11
- Metrics and KPIs 10

A study plan

8 new cards a day covers everything in a month, leaving the last weeks for review.
5 new cards a day covers everything in two months, leaving the last weeks for review.

Willys schedules reviews for you (FSRS spaced repetition), so the daily number above is only for new cards; reviews of what you have learned come back on their own. Study a topic's cards right after you meet it in class, suspend topics you have not reached yet, and use the app's quiz mode in the final two weeks.

How to get these decks

Install Willys on your iPhone, iPad or Mac — App Store. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
Study. The exam comes in as its own collapsible folder, every card scheduled by FSRS spaced repetition. Nothing you already have is changed.

Every deck is built into Willys

All 3 CompTIA CySA+ decks (213 cards), with FSRS spaced repetition, quizzes and mock tests, on iPhone, iPad and Mac. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

CompTIA CySA+ CS0-003 (V3) exam objectives, document version 6.0 — topic outline only; no text copied
Checked against the FIRST CVSS v3.1 and v4.0 specifications and the FIRST EPSS documentation, MITRE ATT&CK Enterprise (content v19.2), the OWASP Top 10:2021 and 2025 (CC BY-SA 4.0), the Lockheed Martin Cyber Kill Chain white paper and the Diamond Model of Intrusion Analysis paper — reference only; no text copied
Checked against Microsoft Learn (Run and RunOnce keys, event 4698, PowerShell -EncodedCommand, the service control manager), RFC 3986, RFC 5321, RFC 7208 (SPF) and RFC 9989 (DMARC, May 2026, which replaced RFC 7489), the nmap, tcpdump and Wireshark documentation, NIST SP 800-215 (public domain) and PCI SSC scanning guidance for PCI DSS v4.0 — reference only; no text copied
CompTIA CySA+ CS0-003 exam objectives — topic outline only; no text copied
Checked against the CompTIA CySA+ CS0-003 (V3) exam objectives, document version 6.0 (topic list only; no text copied).
Checked against the FIRST CVSS v3.1 specification, MITRE ATT&CK Enterprise v19 tactics and techniques, RFC 9989 (DMARC, which obsoletes RFC 7489), RFC 7208 (SPF), RFC 5321 (Received trace headers) and RFC 3227 (order of volatility), NIST SP 800-61 Rev. 2 (withdrawn and superseded by Rev. 3; used for severity factors and incident communications), SP 800-61 Rev. 3, SP 800-86 and the SP 800-53 Rev. 5 glossary (public domain), and the CISA Known Exploited Vulnerabilities catalogue.
Also checked against the OWASP Top 10:2021 and OWASP Cheat Sheet Series (CC BY-SA 4.0), the Lockheed Martin Cyber Kill Chain and Diamond Model of Intrusion Analysis papers, and Microsoft, AWS, Red Hat, VirusTotal, Prowler and Pacu documentation (reference only).

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.

Use of these pages is covered by our Terms of Use.