01
Understand
Read two focused lessons for each objective. Work through examples and check the takeaways.
CyberCorps.uk · CS0-004
CySA+ v4
Learn to think like a security analyst. Connect the concepts, investigate realistic scenarios, and practise making decisions you can explain.
- Study modules
- 15
- Original lessons
- 30
- Practical labs
- 17
Your learning progress
Loading your progress…
Progress is saved in this browser.
02
Apply
Make decisions in an analyst scenario, then use the linked labs to practise with real tools.
03
Review
Answer three applied questions per module and use the explanations to close gaps in your reasoning.
Your learning path
From evidence to action
Four domains, with a module for each objective in the supplied CS0-004 outline.
1. Security Operations
Understand your environment, investigate activity, and improve the analyst workflow.
- 1.1
Architecture and visibility
Map the systems, identities, and data flows behind an alert. Explain how architecture determines what evidence exists and which response actions are appropriate.
2 lessons · Scenario · Knowledge check →
- 1.2
Recognizing malicious activity
Evaluate suspicious network, host, application, cloud, and identity behaviour using corroborating evidence. Distinguish an indicator from a confirmed conclusion.
2 lessons · Scenario · Knowledge check →
- 1.3
Investigation tools
Choose tools that answer a specific investigative question. Preserve originals, interpret structured evidence, and correlate tool output without mistaking a score for a finding.
2 lessons · Scenario · Knowledge check →
- 1.4
Threat intelligence and hunting
Turn external threat information into locally relevant hypotheses. Evaluate confidence, map behaviour, and design hunts whose results can improve detection.
2 lessons · Scenario · Knowledge check →
- 1.5
Efficient security operations
Design repeatable analyst workflows and integrations that improve decisions. Measure outcomes, tune alerts, and automate tasks with appropriate failure handling and oversight.
2 lessons · Scenario · Knowledge check →
- 1.6
AI for security analysts
Use AI to assist analysis and documentation while preserving evidence and decision ownership. Identify hallucination, exposure, poisoning, and prompt-injection risks and apply proportionate controls.
2 lessons · Scenario · Knowledge check →
2. Vulnerability Management
Plan assessments, interpret evidence, and reduce the risks that matter.
- 2.1
Planning vulnerability assessments
Design an assessment that answers a defined security question while respecting service availability. Select complementary scanning methods and make coverage gaps visible.
2 lessons · Scenario · Knowledge check →
- 2.2
Interpreting assessment results
Translate scanner, web, cloud, and control-validation output into claims supported by evidence. Recognise what each tool can establish and choose a proportionate next check.
2 lessons · Scenario · Knowledge check →
- 2.3
Prioritizing and remediating risk
Build a remediation queue from evidence, exposure, exploitation likelihood, and business consequence. Select workable treatments and verify that the relevant risk actually changed.
2 lessons · Scenario · Knowledge check →
- 2.4
Governing vulnerability management
Connect technical findings to accountable risk decisions and repeatable security practices. Evaluate control purpose, remediation objectives, software assurance, and dependencies on external suppliers.
2 lessons · Scenario · Knowledge check →
3. Incident Response and Management
Make defensible response decisions, preserve evidence, and restore services.
- 3.1
Attack methodology frameworks
Use the Cyber Kill Chain, Diamond Model, and MITRE ATT&CK to explain an intrusion, identify missing evidence, and choose the next defensive question.
2 lessons · Scenario · Knowledge check →
- 3.2
Managing the incident lifecycle
Move an incident from preparation and triage to controlled recovery, using explicit authority, impact assessment, and evidence-based exit criteria.
2 lessons · Scenario · Knowledge check →
- 3.3
Evidence and response techniques
Execute a response with clear authority, a defensible timeline, preserved evidence, and verified restoration.
2 lessons · Scenario · Knowledge check →
4. Reporting and Communication
Turn findings into clear decisions, action plans, and effective handovers.
- 4.1
Communicating vulnerability risk
Turn scan output into accountable remediation decisions, and report progress with business context, dependencies, and honest measures.
2 lessons · Scenario · Knowledge check →
- 4.2
Incident reporting and handover
Communicate an incident clearly across audiences and shifts, preserving operational security, decision ownership, and measurable lessons.
2 lessons · Scenario · Knowledge check →
Take the learning into the lab
All 17 handouts are ready to use. Build your toolkit with Wireshark, Sysinternals, CyberChef, and YARA, then work through the Docker vulnerability range.
Browse the practical labs →