Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

CompTIA CySA+ (CS0-004) Complete Course & Practice Exam

Name: CompTIA CySA+ (CS0-004) Complete Course & Practice Exam
Rating: 4.6 (12571 reviews)

Pass the CompTIA Cybersecurity Analyst+ (CS0-004) exam on your 1st attempt, includes a full practice exam!

Bestseller

Highest Rated

Created byJason Dion • 3 Million+ Enrollments Worldwide, Dion Training Solutions • ATO for ITIL & PRINCE2, Dion Training Solutions • ATO for ITIL & PRINCE2, Dion Training Solutions, Jason Dion • 2.8 Million+ Enrollments Worldwide

Last updated 7/2026

English

Arabic [Auto],Czech [Auto],

What you'll learn

Monitor and analyze security events using SIEM, EDR, and other industry-standard security tools
Detect indicators of compromise across endpoints, networks, cloud environments, and identities
Perform threat hunting, vulnerability analysis, and risk-based remediation using real-world techniques
Execute the complete incident response lifecycle, from detection and containment to recovery
Collect and analyze digital evidence, create incident response playbooks, and produce professional reports
Apply security automation, AI-assisted analysis, and prepare for the CompTIA CySA+ (CS0-004) exam

Course content

45 sections • 323 lectures • 51h 40m total length

Welcome and Course Overview12:30
The Cybersecurity Analyst Role9:22
Discover how a cybersecurity analyst monitors, detects, analyzes, and responds to threats across tier 1–3 in modern hybrid environments. Leverage SIEM, EDR, MITRE ATT&CK, and SOAR.
CySA+ CS0-004 Exam Structure and Domains10:06
Your Course Roadmap How to Maximize Your Results9:59
Navigate the CS0-004 CySA+ course with a four-phase roadmap from operating environment, through detection and analysis and vulnerability management and incident response, to reporting and communication.
Download your free study guide0:04

Introduction to Security Operations Centers (SOC) (OBJ. 1.5)11:18
SOC Roles and Responsibilities (OBJ. 1.5)10:55
Outline the SOC tier structure and roles from tier 1 alert triage to tier 3 threat hunting, and explain specialist roles like threat intelligence analyst and incident responder.
Security Operations Workflows and Processes (OBJ. 1.5)9:29
Continuous Monitoring Concepts (OBJ. 1.1)12:03
Shift Operations and Handover Procedures (OBJ. 4.2)10:14
Checkpoint: Foundational Security Operations

Understanding Risk in Cybersecurity (OBJ. 2.4)8:36
Understand risk in cybersecurity as the intersection of threat, vulnerability, and impact. Learn to measure it with quantitative and qualitative methods for informed prioritization.
Risk Concepts: Appetite, Residual, and Inherent Risk (OBJ. 2.4)8:48
Explore inherent risk, residual risk, and risk appetite, and learn how controls and risk tolerance shape risk management using the six-step RMF.
Risk Management Strategies (Accept, Transfer, Avoid, Mitigate) (OBJ. 2.4)10:08
Security Control Types (OBJ. 2.4)10:29
Examine administrative, technical, and physical controls, how defense in depth layers them to protect assets, and how compensating controls mitigate gaps in legacy systems to reduce risk.
Security Control Functions (OBJ. 2.4)11:07
Explore how administrative, technical, and physical controls serve preventive, detective, responsive, and corrective functions to stop, detect, contain, and recover from incidents.
Policies, Governance, and Service-Level Objectives (SLOs) (OBJ. 2.4)11:29
Aligning Controls with Business Risk (OBJ. 2.4)12:34
Checkpoint: Risk Management and Security Controls

Infrastructure and System Architecture Overview (OBJ. 1.1)8:51
Cloud Native Architecture (OBJ. 1.1)9:02
Virtualization Technologies and Security (OBJ. 1.1)8:49
Containerization Concepts (Docker, Kubernetes) (OBJ. 1.1)8:54
Learn containerization with Docker and Kubernetes, and identify risks like poisoned images, container escapes, and exposed API servers; monitor with Falco and Kubernetes audit log, applying least privilege.
Application Programming Interfaces (API) Concepts (OBJ. 1.1, 1.5)8:28
Demo: Detecting API Enumeration Through Log Analysis8:07
Detect potential API enumeration through log analysis by examining repeated requests and sequential user IDs, and assess for broken object-level authorization.
Device Management Concepts (OBJ. 1.1, 1.3)9:51
Checkpoint: System Infrastructure Concepts

Network Architecture Fundamentals (OBJ. 1.1)8:23
Zero Trust Network Architecture (ZTNA) (OBJ. 1.1)9:23
Adopt ZTNA by never trusting by default and always verifying, using IAM, device trust, and microsegmentation with policy based enforcement. This improves access controls and reduces blast radius.
Secure Access Service Edge (SASE) (OBJ. 1.1)9:25
Hybrid Cloud Networking (OBJ. 1.1)9:14
Network Segmentation and Isolation (OBJ. 2.1)9:08
Network Security Best Practices (OBJ. 2.1)9:35
Demo: Detecting Command-and-Control Beaconing with Wireshark9:32
Checkpoint: Network Architecture Concepts

Introduction to Critical Infrastructure (OBJ. 1.1)8:27
Operational Technology (OT) Fundamentals (OBJ. 1.19:06
Industrial Control Systems (ICS) (OBJ. 1.1)9:27
Explore industrial control systems as the OT subset that automates processes with PLCs, a control server, HMIs, and the data historian, and distinguish DCS from SCADA for security implications.
SCADA Systems (OBJ. 1.1)9:48
Explore how SCADA systems manage multi-site operations with MTU and RTUs, how IP-based communications expand attack surfaces, and Stuxnet's threat model.
OT/ICS/SCADA Threat Landscape (OBJ. 1.1, 1.2)10:32
Security Considerations for Critical Infrastructure (OBJ. 1.1)11:08
Checkpoint: Introduction to Critical Infrastructure

Operating System Security Concepts (OBJ. 1.1)9:21
Map OS architecture to detection strategy by examining the kernel and user space boundaries, and hardware protections like ASLR and DEP, with OS telemetry driving threat hunting and security operations.
System Hardening Fundamentals (OBJ. 1.1)8:34
Windows File Structure and Critical Files (OBJ. 1.1)9:22
Linux File Structure and Critical Files (OBJ. 1.1)10:39
System Processes and Services (OBJ. 1.1, 1.2)9:37
Demo: Investigating a Suspicious Process11:41
OS Security Configuration Best Practices (OBJ. 1.1)9:51
Checkpoint: Operating System Security

Fundamentals of Security Logging (OBJ. 1.1)7:50
Log Ingestion Methods and Strategies (OBJ. 1.1)7:51
Log Configuration Best Practices (OBJ. 1.1)8:27
Ensuring Log Integrity and Security (OBJ. 1.1)7:38
Time Synchronization and NTP (OBJ. 1.1)8:24
Learn how time synchronization with NTP keeps clocks aligned for log analysis and timelines, covering stratum levels, UDP 123, UTC logging, and mitigations like disabling monlist and authenticated NTP.
Log Retention Policies and Compliance (OBJ. 1.1)8:11
Basic Log Analysis Techniques (OBJ. 1.3)9:18
Demo: Detecting a Brute Force Attack through Log Analysis13:17
Checkpoint: Logging Concepts and Analysis

Identity and Access Management Fundamentals (OBJ. 1.110:21
Master identity and access management fundamentals, including identity management and authentication. Explore authorization, federation, single sign-on, least privilege, orphaned accounts, and sign-in logs for threat detection.
Privileged Access Management (PAM) (OBJ. 1.1)9:13
Authentication Methods and Technologies (OBJ. 1.1)10:15
Authorization Models and Mechanisms (OBJ. 1.1)9:45
Explore authorization models and mechanisms, including DAC, MAC, RBAC, ABAC, and PBAC, and apply least privilege and ACLs to detect and analyze access misuse in enterprise environments.
Secrets Management Best Practices (OBJ. 1.1)9:29
IAM Security Considerations (OBJ. 1.1, 1.2)10:29
Demo: Detecting Privilege Escalation Through Group Membership Changes13:06
Checkpoint: Identity and Access Management

Introduction to Data Protection and Encryption6:36
Data Protection Concepts and Strategies (OBJ. 1.1)8:47
Identify data states: at rest, in transit, and in use, and apply encryption and data loss prevention. Recognize PII, PHI, and CHD with GDPR, HIPAA, and PCI DSS.
Encryption Fundamentals (OBJ. 1.1)9:07
Symmetric vs. Asymmetric Encryption (OBJ. 1.1)9:17
Encryption Techniques and Applications (OBJ. 1.1)8:43
Data Classification and Handling (OBJ. 1.1)9:18
Detecting Data Exfiltration (OBJ. 1.1)10:02
Demo: Detecting Data Exfiltration Using Encrypted Archives12:06
Checkpoint: Data Protection and Encryption

Requirements

A basic understanding of networking and cybersecurity concepts
Experience using Windows and Linux operating systems
Familiarity with firewalls, SIEMs, and endpoint security tools is recommended
A computer with internet access capable of running virtualization software for hands-on labs
Some SOC or IT security experience is helpful but not required
A willingness to learn practical cybersecurity analysis and incident response techniques

Description

Become a Skilled Cybersecurity Analyst

Cybersecurity professionals play a critical role in protecting organizations from today's evolving threat landscape. The CompTIA CySA+ (CS0-004) certification validates the practical skills needed to detect threats, manage vulnerabilities, respond to security incidents, and support modern Security Operations Center (SOC) environments.

Dion Training's CompTIA CySA+ (CS0-004) Certification Course is designed to help you confidently prepare for the latest certification exam while developing the real-world knowledge employers value. Through expert instruction, comprehensive study materials, and exam-focused practice, you'll learn how to analyze security events, prioritize vulnerabilities, investigate incidents, and effectively communicate security findings. The course is fully aligned with the official CompTIA CS0-004 exam objectives and emphasizes practical application to help you succeed on the exam and in your cybersecurity career.

Course Domains

The CompTIA CySA+ (CS0-004) certification exam measures knowledge across four primary domains:

Security Operations (34%) Learn the core responsibilities of modern security operations, including system and network architecture, threat detection, malicious activity analysis, threat intelligence, security monitoring, automation, and the role of AI in cybersecurity operations. This domain builds the analytical skills needed to identify and respond to threats within enterprise environments.
Vulnerability Management (26%) Develop the knowledge required to identify, assess, prioritize, and mitigate vulnerabilities across an organization's infrastructure. You'll explore vulnerability scanning methodologies, assessment tools, risk-based remediation, governance concepts, and best practices for reducing an organization's attack surface.
Incident Response and Management (24%) Master the incident response lifecycle by learning how to prepare for, detect, analyze, contain, eradicate, recover from, and document cybersecurity incidents. You'll also examine attack frameworks, evidence handling, root cause analysis, and response planning to effectively manage security events.
Reporting and Communication (16%) Build the communication skills needed to deliver meaningful security reports to technical teams, management, and stakeholders. This domain covers vulnerability reporting, incident documentation, executive summaries, security metrics, compliance reporting, and communicating actionable recommendations that support informed business decisions.

Course Features

Dion Training's CompTIA CySA+ (CS0-004) course provides a complete, exam-focused learning experience designed to help you master the objectives covered on the certification exam. Each lesson explains complex cybersecurity concepts in a practical, easy-to-follow format while reinforcing the knowledge needed to succeed in real-world security operations.

The course includes a comprehensive study guide that aligns with the official CompTIA exam objectives, making it easy to review key concepts and reinforce your understanding throughout your studies. You'll also test your progress with section quizzes that help identify areas for additional review and strengthen your exam readiness. To complete your preparation, you'll receive one full-length practice exam that closely mirrors the format, style, and difficulty of the official CompTIA CySA+ (CS0-004) certification exam, allowing you to assess your readiness and build confidence before exam day.

Ready to Earn Your CompTIA CySA+ Certification?

Whether you're preparing to validate your cybersecurity skills or take the next step in your security career, this course provides the structured instruction and exam-focused resources you need to prepare with confidence.

Enroll today and start your journey toward earning the CompTIA CySA+ (CS0-004) certification with Dion Training.

Upon completion of this course, you will earn 55 CEUs towards the renewal of your CompTIA A+, Network+, Security+, Linux+, Cloud+, PenTest+, CySA+, or CASP+ certifications.

Who this course is for:

SOC Analysts looking to advance their threat detection and incident response skills
Cybersecurity, Security Operations, and Incident Response Analysts
Security Engineers, Security Administrators, and Security Consultants
Vulnerability Management and Threat Intelligence professionals
Network and IT professionals transitioning into defensive cybersecurity roles
Anyone preparing for the CompTIA CySA+ (CS0-004) certification exam

CompTIA CySA+ (CS0-004) Complete Course & Practice Exam

What you'll learn

Explore related topics

Course content

Introduction to CompTIA CySA+5 lectures • 42min

Foundational Security Operations5 lectures • 54min

Risk Management and Security Controls7 lectures • 1hr 13min

System Infrastructure Concepts7 lectures • 1hr 2min

Network Architecture Concepts7 lectures • 1hr 5min

Introduction to Critical Infrastructure6 lectures • 58min

Operating System Security7 lectures • 1hr 9min

Logging Concepts and Analysis8 lectures • 1hr 11min

Identity and Access Management7 lectures • 1hr 13min

Data Protection and Encryption8 lectures • 1hr 14min

Requirements

Description

Who this course is for: