CompTIA CySA+ Cybersecurity Analyst Certification (CS0-004)

كن محلّلاً متمكّناً في الأمن السيبراني. تحلّل مؤشرات النشاط الخبيث

5 أياممتوسط14 وحدةCS0-004CompTIA CySA+

نظرة عامة

كن محلّلاً متمكّناً في الأمن السيبراني. تحلّل مؤشرات النشاط الخبيث، وتستخدم أدوات SIEM وEDR وتحليل الحزم، وتطبّق استخبارات التهديدات وتعقّبها، وتدير الثغرات، وتستجيب للحوادث، وتعدّ التقارير بفعالية، استعداداً لامتحان CySA+ CS0-004.

ما ستتعلّمه

المحتوى التقني أدناه معروضٌ باللغة الإنجليزية كما ورد في منهاج الدورة، حفاظاً على دقّة المصطلحات.

Explain system and network architecture concepts that support secure operations, including logging, identity, encryption, and modern frameworks (ZTNA, SASE, cloud-native).
Detect and analyze indicators of potentially malicious activity across networks, endpoints, cloud, and identity systems.
Use industry-standard tools and methods, SIEM, EDR/XDR, packet analyzers, and threat intelligence platforms, to determine malicious activity.
Apply threat intelligence and threat-hunting concepts to proactively identify and investigate threats.
Run a vulnerability management program: scanning, analysis, prioritization (CVSS and EPSS), and risk-based remediation.
Execute the incident response lifecycle from detection through containment, eradication, recovery, and post-incident activities.
Summarize AI use cases, security risks, and governance considerations within security operations.
Produce clear vulnerability and incident response reporting that drives stakeholder decisions.

المنهاج

14 وحدة

Logging concepts: ingestion, configuration, integrity and security, time synchronization, and retention
Operating system concepts, hardening, file structures, and critical processes
Infrastructure concepts: cloud-native, virtualization, containerization, and APIs
Network architecture: Zero Trust Network Access (ZTNA), SASE, and hybrid cloud
Identity and access management: PAM, authentication/authorization methods, and secrets management
Encryption, data protection, and OT/ICS/SCADA fundamentals
Security control types (physical, technical, administrative) and control functions

Network-based indicators: rogue devices, enumeration, and unexpected ports/traffic
Host-based indicators: resource spikes, unauthorized software, LOLBins, and file changes
Application- and cloud-based anomalies
Identity-based indicators: impossible travel and unauthorized access
Social engineering and Business Email Compromise (BEC)

Packet capture and analysis (Wireshark, tcpdump) and IDS/IPS engines (Snort, Suricata, Zeek)
SIEM, EDR/XDR, and threat intelligence platforms (TIPs)
File and reputation analysis; common log and file formats (JSON, XML, YAML, EVTX)
Scripting for analysis with Python, PowerShell, and shell

Threat actors, motivations, and TTPs; MITRE ATT&CK and the pyramid of pain
Indicators of compromise: collection, analysis, and application (atomic vs. behavioral)
Threat modeling (STRIDE), threat mapping, and cyber deception

Standardized playbooks and runbooks; SOAR and automation/orchestration
Data enrichment, alert and rule tuning, and dashboards
Tool integration via APIs, webhooks, and plug-ins

AI use cases in the SOC: log analysis, event correlation, documentation, investigations, and automation
AI security risks: hallucinations, data exposure, model poisoning, and malicious prompts (prompt injection)
AI governance and oversight: usage policies and legal/regulatory considerations

Asset discovery and inventory; scan planning for scope, sensitivity, segmentation, and regulatory needs
Internal vs. external, agent vs. agentless, credentialed vs. non-credentialed, active vs. passive scanning
Baseline and compliance scanning (PCI DSS, CIS, ISO 27000)

Interpreting scanner output; validating, consolidating, and deduplicating findings
Risk scoring with CVSS plus context; prioritization using the Exploit Prediction Scoring System (EPSS)
Handling false positives and tracking exceptions
Software supply chain security and Software Bill of Materials (SBOM)

Controls to mitigate: patching, configuration changes, and compensating controls
Change windows, rollback planning, retesting, and remediation validation
Risk-based remediation planning and inhibitors to remediation

Cyber kill chain, MITRE ATT&CK, and the Diamond Model of Intrusion Analysis
Testing guides and methodologies (OSSTMM, OWASP) for context

Lifecycle: detection, analysis, containment, eradication, and recovery
Evidence acquisition and digital forensics fundamentals
Root-cause analysis

Incident response plans, tooling, and playbooks
Tabletop exercises and training; business continuity and disaster recovery alignment
Post-incident review and lessons learned

Compliance reporting, action plans, and inhibitors to remediation
Metrics and KPIs; communicating risk to stakeholders

Incident declaration, escalation, and stakeholder identification
Incident reporting, root-cause summaries, and lessons-learned communication

لمن هذه الدورة

محلّلو الأمن وموظفو مراكز العمليات الأمنية بمستوى معرفة Security+.

قبل أن تبدأ

Approximately three to four years of hands-on information security or related experience. CompTIA Security+ (or equivalent knowledge and experience) is recommended prior to attending.

الشهادة

الشهادة التي تؤهّلك لها

CompTIA

CompTIA CySA+

CS0-004

دورة واحدة

شهادة ←

الدبلومات

جزءٌ من هذه الدبلومات

دبلوم العالمية في تحليل الأمن السيبراني

يوم واحد

تفاصيل الدورة ←

لنرسم خطوتك التالية معاً.

أخبرنا بالدورة أو الشهادة التي تهمّك، ونرسل لك المنهاج والمواعيد القادمة والرسوم وخيارات التدريب الخاص لفريقك.

تحدّث إلى مستشار ←واتساب