CySA+ exam prep: performance-based labs
In analyst simulations like the CySA+ ones you make decisions from logs, scan reports, emails, packet captures and process trees.
Level 301 · 14 lessons · 12 practice labs
Lessons
Detection simulations
- Approaching analyst simulations
- Classifying an attack from log fragments
- Prioritising from a scan report
- Blocking the attack source on the firewall
- Finding the forged sender in a phishing email
- Short task: prove which of three alerts is real
Analysis simulations
- Command-and-control traffic in a packet capture
- Finding the malicious chain in a process tree
- Prioritising response steps
- Calculating a CVSS score from its vector
- Reading a suspicious script and explaining what it does
- Short task: extract every trace of the attack on one endpoint
Timed practice
- Timed practice: a time budget per question
- Capstone: a timed set of analyst simulations
Practice labs
- Sort log fragments by attack type: You drag eight log fragments under scanning, brute force, injection and exfiltration.
- Prove which of three alerts is real: You examine the logs behind three alerts and show with evidence lines that only one is real.
- Extract every trace on one endpoint: You sweep process, file, network and persistence records and compile a complete list of the attack's indicators.
- Calculate a CVSS score from its vector: You read four vector strings, calculate the base scores and rank them by severity.
- Set the priority order in a scan report: You rank fifteen findings by asset criticality and exploitability and write reasons for the top three.
- Prioritise response steps: With two incidents running at once you put containment, evidence collection and notification steps in the right order and justify it.
- Find the forged sender in a phishing email: In a header viewer you mark the real sending server, the reply address and the failed authentication result.
- Find command-and-control traffic in a capture: In Wireshark you filter regular, small requests to one destination and identify the command server.
- Show the malicious chain in a process tree: You mark the chain from a document viewer to a shell to a download tool in the tree and write each link's command line.
- Explain what a suspicious script does: You decode an encoded shell script and explain line by line the address it downloads from, the file it writes and the persistence it sets.
- Block the attack source on the firewall: You add a rule blocking the attacker's network in the right place in the rule table and test that legitimate traffic is unaffected.
- Four analyst simulations in twenty-five minutes: You complete log classification, capture analysis, process tree and prioritisation questions on a time budget.
About this course
In analyst simulations like the CySA+ ones you make decisions from logs, scan reports, emails, packet captures and process trees.
What you will learn
- Detection simulations
- Analysis simulations
- Timed practice
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run on your own Kali Linux desktop in the browser, with the tools ready in their windowed interfaces. Nothing to install; a computer screen is recommended.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.