CySA+ v4 · Objective 1.1

Architecture and visibility

Map the systems, identities, and data flows behind an alert. Explain how architecture determines what evidence exists and which response actions are appropriate.

What you will be able to do

  • Design a log collection plan that preserves context and integrity.
  • Distinguish host, virtual machine, container, and cloud visibility.
  • Trace authentication, authorization, and secrets across a service.
  • Choose proportionate monitoring for enterprise and operational technology.

Learn the concepts

  1. Lesson 1

    Collect evidence across systems

    An alert describes one observation. Architecture tells you which other observations should exist, where to collect them, and where your view may be incomplete.

    Open lesson →
  2. Lesson 2

    Connect trust, data, and physical impact

    A network boundary does not explain who may use a service or what happens if it stops. Combine identity, data protection, and operational context before choosing a control.

    Open lesson →

Apply your judgement · Synthetic scenario

The export with two different clocks

A distributor detects an unusual customer export from a cloud application that reads an on-premises database. The alert includes a valid service identity, but the owning team cannot explain the request.

API audit
14:02:10Z export.create; principal=svc-support; result=allowed
Identity audit
14:01:47Z token issued; device=unmanaged-27
Database log
14:06:12 local time; bulk read; host clock reports +4 minutes drift
Pipeline health
Database collector last delivered records at 14:20Z

Your task

  1. Build a provisional sequence and state its timestamp limitations.
  2. Identify the access and logging controls requiring investigation.
  3. Propose a response that preserves evidence and tests the outcome.
Compare your response

Authentication and the export request appear close together, but database clock drift and delivery delay prevent a precise ordering without correction. Preserve original times, offsets, and source records.

Investigate how an unmanaged device obtained the service token, the role’s export permissions, secrets access, and the application owner’s approval records. A valid token does not prove an authorised use.

Preserve the relevant audit data, seek approval to restrict the affected credential or export permission, and coordinate with the service owner. Verify that unintended exports stop while required customer support activity still works.

Put it into practice

Use these labs alongside this module.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. An API record reaches the SIEM twenty minutes after the action. Which timeline approach is strongest?
2. A cloud storage object is encrypted, but a compromised service account downloads its plaintext through the normal API. Which control gap best explains this?
3. A suspected controller on a production line produces unusual traffic. What should an analyst do before running a disruptive diagnostic?

0 of 3 answered

← Course curriculumNext module: 1.2 →

Source reading: supplied book, chapters 2. Lessons, scenarios, and questions are original CyberCorps course material.