Study Hub / CompTIA CySA+ (CS0-004) / Domain 1.0
CompTIA CySA+ (CS0-004) Domain 1.0: Security Operations — Explained
Domain 1.0 is the analyst's home turf: how a SOC turns a flood of alerts into confirmed incidents. SIEM analysis, alert triage, tuning out noise, and hunting for what the alerts missed — the daily craft of cybersecurity analysis.
The SOC and the analyst workflow
- SOC tiers — Tier 1 triages alerts (real or noise?), Tier 2 investigates and escalates, Tier 3 hunts and handles advanced cases. The exam frames many scenarios as "you are the analyst" — think in tiers.
- The analysis pipeline — alert fires → triage (is it real?) → investigate (scope: what/where/how far?) → contain/eradicated per playbook → lessons learned. Analysts don't just close alerts; they determine blast radius.
- True/false positives/negatives — true positive: real attack, alerted. False positive: benign, alerted (noise). False negative: real attack, missed (the dangerous one). Tuning reduces FPs without creating FNs.
- Alert fatigue — too many false positives and analysts start ignoring alerts — including real ones. Tuning isn't cosmetic; it's a safety control.
SIEM: correlation and analysis
- What SIEM does — aggregates logs from everywhere (firewalls, endpoints, servers, cloud), normalizes them into common fields, correlates across sources, and fires alerts on detection rules.
- Correlation rules — "impossible travel" (logins from two countries minutes apart), "5 failed logins then a success" (brute force → compromise), "new admin account + mass file access." Single events are noise; patterns across sources are detections.
- Baselining and anomalies — learn normal (this server talks to these hosts at these hours), alert on deviation. UEBA extends this to users: the CFO downloading gigabytes at 3 AM isn't "normal CFO."
- Log sources that matter — authentication logs (who got in), firewall/proxy (where traffic went), endpoint (what ran), DNS (what resolved — C2 loves DNS), email gateway (phishing entry), cloud audit (who did what to the infrastructure).
Tuning, hunting, and automation
- Tuning — adjust rules to cut false positives: whitelist known-good behavior, raise thresholds, add context (alert only if the host is also missing the patch). Every tuning change risks false negatives — validate.
- Threat hunting — proactive searching for undetected compromise, hypothesis-driven: "if APT-X were here, they'd use technique Y — let me look for Y's artifacts." Hunting finds what detections miss.
- Threat intelligence — IOCs (hashes, IPs, domains — atomic, expire fast) vs. TTPs (techniques — durable, behavioral). Feed IOCs to the SIEM; hunt for TTPs.
- SOAR and playbooks — automate the repeatable: isolate host, block hash, open ticket, notify. Automation handles volume; analysts handle judgment.
- Metrics that matter — MTTD (mean time to detect), MTTR (mean time to respond), false-positive rate. What gets measured gets tuned.
The must-memorize table: alert outcomes
Every alert lands in one of four boxes.
| Alert fired? | Attack real? | Outcome | Response |
|---|---|---|---|
| Yes | Yes | True positive | Investigate, scope, respond per playbook |
| Yes | No | False positive | Tune the rule; don't punish the analyst |
| No | Yes | False negative | Dangerous — improve detection coverage |
| No | No | True negative | The quiet majority; normal operations |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An analyst notices the same benign vulnerability-scanner traffic alerting 200 times a day, burying real alerts. What is the correct action?
- A. A. Ignore all scanner-related alerts permanently
- B. B. Tune the rule — whitelist the known-good scanner source to cut false positives
- C. C. Delete the SIEM rule entirely
- D. D. Tell analysts to work faster
Show answer & reasoning
B. Known-good, expected traffic generating alerts is the textbook false-positive tuning case: whitelist the scanner's source so the rule still fires for unexpected scan-like traffic. Deleting the rule (C) creates a blind spot (false negatives); ignoring (A) trains analysts to ignore the category.
2. A SIEM fires: "impossible travel — user logged in from New York and London 20 minutes apart." What kind of detection is this?
- A. A. A signature match on malware
- B. B. A correlation rule combining authentication events across sources into a suspicious pattern
- C. C. A false positive by definition
- D. D. A vulnerability scan result
Show answer & reasoning
B. Neither login alone is suspicious — the combination (same identity, impossible geography, tiny window) is. That's correlation: multiple events + logic = detection. It could still be a VPN artifact (investigate before declaring compromise), but the mechanism is correlation, not signatures (A).
3. A hunter hypothesizes: "If ransomware were staging here, we'd see mass file renames plus shadow-copy deletion." She searches logs for both. What is she doing?
- A. A. Alert triage
- B. B. Hypothesis-driven threat hunting — proactively searching for undetected adversary behavior
- C. C. Vulnerability scanning
- D. D. Incident containment
Show answer & reasoning
B. Threat hunting starts from a hypothesis about how an adversary would behave and searches for its artifacts — proactive, not alert-driven. Triage (A) reacts to alerts; this hunt assumes the alerts missed something. TTPs (behaviors) over IOCs.
4. After a phishing incident, the SOC automates: isolate host → block sender domain → open ticket → notify the user's manager. What is this?
- A. A. A threat hunt
- B. B. A SOAR playbook — automated response to a repeatable incident type
- C. C. A vulnerability scan
- D. D. A penetration test
Show answer & reasoning
B. Repeatable, well-understood response steps are playbook material; SOAR executes them automatically at machine speed. Phishing triage happens dozens of times — automating the mechanical steps (isolate, block, ticket) frees analysts for the judgment parts (was it targeted? who else got it?).
This was one domain. The simulator drills all 4.
This free preview covered Security Operations (Domain 1.0, 34%). Not covered here: Reporting and Communication (Domain 4.0, 16%). The reporting and communication domain plus advanced vulnerability-management and threat-hunting detail stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CySA+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy