Skip to content

CySA+ (CS0-003) — Coverage Map

This page is Step 2 of the repo's how to prepare a certification method: the contract between you and the exam. The official objectives document lists everything CompTIA can ask; this map lists everything this hub teaches. Lining the two up tells you, before you study, what is covered, what is thin, and what is missing.

The rows are the section headings that exist in this hub's four domain pages — nothing more. The official objective numbers are not reproduced here (the hub does not carry CompTIA's numbering, and this page will not invent it), so the first column is yours to fill.

How to fill it in:

  1. Download the official CS0-003 exam objectives PDF (or the CS0-004 PDF if you will sit after the CS0-003 English retirement on 2026-12-22 — see the version notice) — the steps are in exam & objectives → how to get the official exam objectives.
  2. Walk the PDF objective by objective. For each one, find the matching row below and write the official number (as printed in the PDF) in the first column. One objective may span several rows, and one row may cover several objectives — record all of them.
  3. Any objective with no matching row goes in the gaps table at the end, marked "gap", with a note on where you will learn it.
  4. Then score every row 0–3 (the scale is in Step 3 of the method) and tick Practised? only after you have done the hands-on item for that topic.

The numbered sections in the domain pages (1. … 6.) are the hub's numbering, not CompTIA's. Domain weights in the group headings are the ones the hub records from CompTIA's page (verify on CompTIA — weightings change per exam version).

How to use

  • Before studying: fill the first column and the self-score column; the zeros and ones are your syllabus. Domains 1 and 2 together carry 63% of the exam — start there.
  • During the study loop: after each domain page, revisit its rows — raise the score, tick Practised? (for CySA+ that means reading real logs, scanner output and packet captures, not just the page), and use Notes for the weak-area log entry.
  • Before booking: the readiness gate (Step 6 of the method) needs every row at 2 or 3 and the gaps table empty or answered.
  • Where a row has a ↳, it is a subsection of the row above it; score it separately only if the PDF treats it as its own objective.
  • Rows link straight to the section, so this page doubles as the hub's fastest index.

Coverage map

Domain 1 — Security Operations (33%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. System and network architecture concepts in operations D1 → section __ ☐
____ ↳ Log ingestion D1 → subsection __ ☐
____ ↳ Operating system, process, and hardware concepts D1 → subsection __ ☐
____ ↳ Network architecture, segmentation, and Zero Trust D1 → subsection __ ☐
____ ↳ Identity and access management (IAM) D1 → subsection __ ☐
____ ↳ Encryption and sensitive-data protection D1 → subsection __ ☐
____ 2. Analyze indicators of potentially malicious activity D1 → section __ ☐
____ ↳ Network-related indicators D1 → subsection __ ☐
____ ↳ Host-related indicators D1 → subsection __ ☐
____ ↳ Application-related indicators D1 → subsection __ ☐
____ 3. Tools and techniques to determine malicious activity D1 → section __ ☐
____ 4. Threat intelligence and threat hunting D1 → section __ ☐
____ ↳ Cyber threat intelligence (CTI) D1 → subsection __ ☐
____ ↳ Threat actors and TTPs D1 → subsection __ ☐
____ ↳ MITRE ATT&CK, IoC vs. IoA D1 → subsection __ ☐
____ ↳ Threat hunting D1 → subsection __ ☐
____ 5. Efficiency and process improvement in security operations D1 → section __ ☐

Domain 2 — Vulnerability Management (30%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Discovery and scanning D2 → section __ ☐
____ ↳ Scan types D2 → subsection __ ☐
____ ↳ Special considerations — fragile and operational technology D2 → subsection __ ☐
____ 2. Analyzing scanner output D2 → section __ ☐
____ 3. Validation — true vs. false, positive vs. negative D2 → section __ ☐
____ 4. Prioritization and context D2 → section __ ☐
____ ↳ CVSS — the three metric groups D2 → subsection __ ☐
____ ↳ Supplementing CVSS — EPSS and CISA KEV D2 → subsection __ ☐
____ 5. Vulnerability response, handling, and management D2 → section __ ☐
____ ↳ Controls by category D2 → subsection __ ☐
____ ↳ Remediation and risk handling D2 → subsection __ ☐
____ 6. Attack frameworks and identifier systems D2 → section __ ☐
____ ↳ CVE, CWE, and scoring systems D2 → subsection __ ☐

Domain 3 — Incident Response and Management (20%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Attack-methodology frameworks D3 → section __ ☐
____ ↳ The Cyber Kill Chain stages D3 → subsection __ ☐
____ ↳ Kill Chain vs. ATT&CK D3 → subsection __ ☐
____ 2. The NIST SP 800-61 incident-response life cycle D3 → section __ ☐
____ ↳ Phase 1 — Preparation D3 → subsection __ ☐
____ ↳ Phase 2 — Detection and Analysis D3 → subsection __ ☐
____ ↳ Phase 3 — Containment, Eradication, and Recovery D3 → subsection __ ☐
____ ↳ Phase 4 — Post-Incident Activity D3 → subsection __ ☐
____ 3. Incident management in practice D3 → section __ ☐

Domain 4 — Reporting and Communication (17%)

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ 1. Vulnerability management reporting and communication D4 → section __ ☐
____ ↳ What gets reported D4 → subsection __ ☐
____ ↳ Metrics and KPIs D4 → subsection __ ☐
____ ↳ Inhibitors to remediation D4 → subsection __ ☐
____ ↳ Stakeholders and due diligence D4 → subsection __ ☐
____ 2. Incident response reporting and communication D4 → section __ ☐
____ ↳ Declaration, escalation, and stakeholders D4 → subsection __ ☐
____ ↳ External communications D4 → subsection __ ☐
____ ↳ Closing the loop — RCA, lessons learned, metrics D4 → subsection __ ☐

Cross-cutting exam skills

Official objective # (record from the PDF) Topic area (as covered here) Where Self-score 0–3 Practised? Notes
____ Performance-based questions (PBQs) — what they are and how to pace them Exam & objectives __ ☐
____ Mixed practice set (all four domains) Practice questions __ ☐

Gaps you found

One row per official objective that has no matching row above. Decide where you will learn it (another page in this repo, the exam body's own material, a lab) and add that source to your plan.

Official objective What is missing Where you will learn it

Sources