CompTIA CySA+ — Security Operations and Vulnerability Management flashcards
10 of 80 cards free to study here · 3 topics · the whole deck is built into Willys
CS0-003 domains 1 and 2 plus objective 3.1, from the analyst's chair: logging and architecture, indicators of malicious activity, Wireshark, nmap and email-header analysis, threat intelligence and hunting, the Kill Chain, ATT&CK and the Diamond Model, scanning, CVSS, prioritisation and mitigations.
Learn deck · part of CompTIA CySA+ · written against: Exam CS0-003 objectives. Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
Events from three servers are being correlated in the SIEM, but one server's entries appear to happen minutes before the activity that caused them. What is the likely cause, and the fix?Clock drift — the servers are not time-synchronised, so correlation puts events in the wrong order. Point every log source at a common NTP source and record timestamps in UTC.Security Operations › Architecture and Logging
Why: a timeline is only as trustworthy as the clocks that wrote it. -
To catch everything, a new SIEM project proposes setting every log source to debug level. Why is that a poor default?Debug logging levels flood storage and the SIEM with low-value events, bury real alerts and drive up ingestion cost. Log security-relevant events (authentication, privilege use, configuration changes) by default and raise verbosity temporarily during an investigation.Security Operations › Architecture and Logging
-
An analyst suspects malware survives reboots on a Windows host. Which registry keys are the classic autostart locations to check first?The Run and RunOnce keys under both HKLM and HKCU, e.g.Security Operations › Architecture and Logging
HKCU\Software\Microsoft\Windows\CurrentVersion\Run. Anything listed there launches when a user logs on, so an unfamiliar binary in a user-writable folder such as AppData or Temp is a strong lead. -
An API moves from virtual machines to serverless functions. What changes for the analyst's visibility?There is no host to install an agent on — the provider runs the operating system — so detection depends on platform logs (function invocations, API gateway and identity logs) and on reviewing function permissions and triggers.Security Operations › Architecture and Logging
Watch out: over-privileged function roles become a key risk. -
What are the seven phases of the Lockheed Martin Cyber Kill Chain, in order?Reconnaissance, weaponization, delivery, exploitation, installation, command and control, actions on objectives.Incident Response and Management › Attack Frameworks
Why: defenders aim to break the chain as early as possible. -
An attacker has packaged an exploit and a backdoor into a malicious PDF but has not sent it yet. Which Kill Chain phase is this?Weaponization — building the deliverable payload. Emailing it would be delivery, and the PDF reader flaw firing would be exploitation.Incident Response and Management › Attack Frameworks
-
What are the four core features of the Diamond Model of Intrusion Analysis?Adversary, capability, infrastructure and victim, linked as the corners of a diamond for each event. Knowing one corner lets analysts pivot to the others.Incident Response and Management › Attack Frameworks
-
Laptops are often off the corporate network when the weekly scan runs. Agent-based or agentless scanning, and why?Agent-based — the installed agent assesses the device locally and reports whenever it is online, wherever it is. Agentless scans need the host reachable from the scanner at scan time.Vulnerability Management › Scanning Methods
-
A non-credentialed scan of a Linux server reports no missing patches, but a credentialed scan lists dozens. Why the difference?A non-credentialed scan sees only what the host exposes on the network (banners, open services). A credentialed scan logs in and reads installed package versions and settings, revealing local vulnerabilities.Vulnerability Management › Scanning Methods
Watch out: the non-credentialed view is closer to what an outside attacker sees, so both are useful. -
Fragile controllers on an OT network crashed during a past scan. Which scanning approach suits that network, and how does it work?Passive scanning — a sensor on a span port or tap identifies devices, protocols and software versions from traffic they already send, without probing them. It is safer for ICS and SCADA but slower and can miss quiet hosts.Vulnerability Management › Scanning Methods
Unlock the whole deck
You are studying a free 10-card sample. All 80 cards of CompTIA CySA+ — Security Operations and Vulnerability Management, the other 2 CompTIA CySA+ decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More CompTIA CySA+ decks
← All CompTIA CySA+ decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- CompTIA CySA+ CS0-003 (V3) exam objectives, document version 6.0 — topic outline only; no text copied
- Checked against the FIRST CVSS v3.1 and v4.0 specifications and the FIRST EPSS documentation, MITRE ATT&CK Enterprise (content v19.2), the OWASP Top 10:2021 and 2025 (CC BY-SA 4.0), the Lockheed Martin Cyber Kill Chain white paper and the Diamond Model of Intrusion Analysis paper — reference only; no text copied
- Checked against Microsoft Learn (Run and RunOnce keys, event 4698, PowerShell -EncodedCommand, the service control manager), RFC 3986, RFC 5321, RFC 7208 (SPF) and RFC 9989 (DMARC, May 2026, which replaced RFC 7489), the nmap, tcpdump and Wireshark documentation, NIST SP 800-215 (public domain) and PCI SSC scanning guidance for PCI DSS v4.0 — reference only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. This product is not affiliated with or endorsed by CompTIA.
Use of these pages is covered by our Terms of Use.