Get the detailed information you need to prepare for the Incident Response and Management domain of the Cybersecurity Analyst+ (CySA+) exam.
CompTIA Cybersecurity Analyst+ (CySA+) (CS0-003) Cert Prep: 3 Incident Response and Management
Overview
Syllabus
Introduction
- Incident response
- What you need to know
- Study resources
- Build an incident response program
- Creating an incident response team
- Incident communications plan
- Incident identification
- Escalation and notification
- Mitigation
- Containment techniques
- Incident eradication and recovery
- Validation
- Post-incident activities
- Incident response exercises
- MITRE ATT&CK
- Diamond model of intrusion analysis
- Cyber kill chain analysis
- Testing guides
- Logging security information
- Security information and event management
- Cloud audits and investigations
- Conducting investigations
- Evidence types
- Introduction to forensics
- System and file forensics
- File carving
- Creating forensic images
- Digital forensics toolkit
- Operating system analysis
- Password forensics
- Network forensics
- Software forensics
- Mobile device forensics
- Embedded device forensics
- Chain of custody
- Ediscovery and evidence production
- Business continuity planning
- Business continuity controls
- High availability and fault tolerance
- Disaster recovery
- Backups
- Restoring backups
- Disaster recovery sites
- Testing BC/DR plans
- After-action reports
- Continuing your studies
Taught by
Mike Chapple
