Transcription
CompTIA CybersecurityAnalyst (CSA ) Cert GuideTroy McMillan800 East 96th StreetIndianapolis, Indiana 46240 USA9780789756954 BOOK.indb i5/19/17 1:39 PM
CompTIA Cybersecurity Analyst (CSA ) Cert GuideCopyright 2017 by Pearson Education, Inc.Editor-in-ChiefMark TaubAll rights reserved. No part of this book shall be reproduced, stored ina retrieval system, or transmitted by any means, electronic, mechanical,photocopying, recording, or otherwise, without written permission fromthe publisher. No patent liability is assumed with respect to the use of theinformation contained herein. Although every precaution has been taken inthe preparation of this book, the publisher and author assume no responsibility for errors or omissions. Nor is any liability assumed for damagesresulting from the use of the information contained herein.Product Line ManagerBrett BartowISBN-13: 978-0-7897-5695-4ISBN-10: 0-7897-5695-1Managing EditorSandra SchroederLibrary of Congress Control Number: 2017938509Printed in the United States of AmericaFirst Printing: June 2017TrademarksAll terms mentioned in this book that are known to be trademarks or service marks have been appropriately capitalized. Pearson IT Certificationcannot attest to the accuracy of this information. Use of a term in this bookshould not be regarded as affecting the validity of any trademark or servicemark.Warning and DisclaimerEvery effort has been made to make this book as complete and as accurateas possible, but no warranty or fitness is implied. The information providedis on an “as is” basis. The author and the publisher shall have neither liability nor responsibility to any person or entity with respect to any loss ordamages arising from the information contained in this book.Special SalesFor information about buying this title in bulk quantities, or for specialsales opportunities (which may include electronic versions; custom coverdesigns; and content particular to your business, training goals, marketingfocus, or branding interests), please contact our corporate sales departmentat corpsales@pearsoned.com or (800) 382-3419.Acquisitions EditorMichelle NewcombDevelopment EditorEllie BruSenior Project EditorTonya SimpsonCopy EditorKitty WilsonIndexerPublishing Works, Inc.ProofreaderChuck HutchinsonTechnical EditorsChris CraytonRobin AbernathyPublishing CoordinatorVanessa EvansCover DesignerChuti PrasertsithCompositorBronkella PublishingFor government sales inquiries, please contactgovernmentsales@pearsoned.com.For questions about sales outside the U.S., please contactintlcs@pearson.com.9780789756954 BOOK.indb ii5/19/17 1:39 PM
Contents at a GlanceIntroductionxxviiCHAPTER 1Applying Environmental Reconnaissance Techniques3CHAPTER 2Analyzing the Results of Network ReconnaissanceCHAPTER 3Recommending and Implementing the Appropriate Response andCountermeasure 69CHAPTER 4Practices Used to Secure a Corporate EnvironmentCHAPTER 5Implementing an Information Security Vulnerability ManagementProcess 113CHAPTER 6Analyzing Scan Output and Identifying Common VulnerabilitiesCHAPTER 7Identifying Incident Impact and Assembling a Forensic ToolkitCHAPTER 8The Incident Response ProcessCHAPTER 9Incident Recovery and Post-Incident Response3795141187213237CHAPTER 10 Frameworks, Policies, Controls, and Procedures251CHAPTER 11 Remediating Security Issues Related to Identity and AccessManagement 301CHAPTER 12 Security Architecture and Implementing Compensating ControlsCHAPTER 13 Application Security Best Practices385CHAPTER 14 Using Cybersecurity Tools and TechnologiesCHAPTER 15 Final PreparationAPPENDIX A343403453Answers to the “Do I Know This Already?” Quizzes and ReviewQuestions 459Glossary 491Index 5269780789756954 BOOK.indb iii5/19/17 1:39 PM
Table of ContentsIntroductionChapter 1xxviiApplying Environmental Reconnaissance Techniques 3“Do I Know This Already?” Quiz 3Foundation Topics 5Procedures/Common Tasks 5Topology Discovery 5OS Fingerprinting 5Service Discovery 6Packet Capture 6Log Review 6Router/Firewall ACLs Review 6E-mail Harvesting 7Social Media Profiling 7Social Engineering 8DNS Harvesting 8Phishing11Variables 11Wireless vs. Wired 12Virtual vs. Physical 13Internal vs. External 14On-premises vs. Cloud 15Tools16Nmap16Host Scanning 19Network Mapping 20Netstat 21Packet Analyzer 23IDS/IPS25HIDS/NIDS27Firewall Rule-Based and Logs 27Firewall Types 27Firewall Architecture 29Syslog30Vulnerability Scanner 309780789756954 BOOK.indb iv5/19/17 1:39 PM
Exam Preparation Tasks 31Review All Key Topics 31Define Key Terms 32Review Questions 32Chapter 2Analyzing the Results of Network Reconnaissance 37“Do I Know This Already?” Quiz 37Foundation Topics 40Point-in-Time Data Analysis 40Packet Analysis 40Protocol Analysis 40Traffic Analysis 40NetFlow Analysis 41Wireless Analysis 43CSMA/CA43Data Correlation and Analytics 45Anomaly Analysis 45Trend Analysis 46Availability Analysis 46Heuristic Analysis 46Behavioral Analysis 47Data Output 47Firewall Logs 47Packet Captures 49Nmap Scan Results 52Port Scans 52Event Logs 53Syslog55IDS Report 56Tools57SIEM57Packet Analyzer 59IDS60Resource Monitoring Tool 61NetFlow Analyzer 61Exam Preparation Tasks 629780789756954 BOOK.indb v5/19/17 1:39 PM
viCompTIA Cybersecurity Analyst (CSA ) Cert GuideReview All Key Topics 62Define Key Terms 63Review Questions 63Chapter 3Recommending and Implementing the Appropriate Response andCountermeasure 69“Do I Know This Already?” Quiz 69Foundation Topics 72Network Segmentation 72LAN72Intranet72Extranet72DMZ73VLANs73System Isolation 75Jump Box 76Honeypot 77Endpoint Security 77Group Policies 78ACLs80SinkholeHardening8182Mandatory Access Control (MAC) 82Compensating Controls 83Control Categories 83Access Control Types 84Administrative (Management) Controls 85Logical (Technical) Controls 85Physical Controls 85Blocking Unused Ports/Services 86Patching 86Network Access Control 86Quarantine/Remediation 88Agent-Based vs. Agentless NAC 88802.1x88Exam Preparation Tasks 909780789756954 BOOK.indb vi5/19/17 1:39 PM
ContentsviiReview All Key Topics 90Define Key Terms 91Review Questions 91Chapter 4Practices Used to Secure a Corporate Environment 95“Do I Know This Already?” Quiz 95Foundation Topics 98Penetration Testing 98Rules of Engagement 100Reverse Engineering 101Isolation/Sandboxing 101Hardware 103Software/Malware 104Training and Exercises 105Risk Evaluation 106Technical Impact and Likelihood 106Technical Control Review 107Operational Control Review 107Exam Preparation Tasks 107Review All Key Topics 108Define Key Terms 108Review Questions 108Chapter 5Implementing an Information Security Vulnerability ManagementProcess 113“Do I Know This Already?” Quiz 113Foundation Topics 117Identification of Requirements 117Regulatory Environments 117Corporate Policy 119Data Classification 119Asset Inventory 120Establish Scanning Frequency 120Risk Appetite 120Regulatory Requirements 121Technical Constraints 121Workflow9780789756954 BOOK.indb vii1215/19/17 1:39 PM
viiiCompTIA Cybersecurity Analyst (CSA ) Cert GuideConfigure Tools to Perform Scans According to Specification 122Determine Scanning Criteria 122Sensitivity Levels 122Vulnerability Feed 123Scope123Credentialed vs. Non-credentialed 125Types of Data 126Server-Based vs. Agent-Based 126Tool Updates/Plug-ins 128SCAP128Permissions and Access 131Execute Scanning 131Generate Reports 132Automated vs. Manual Distribution 132Remediation 133Prioritizing133Criticality 134Difficulty of Implementation 134Communication/Change Control 134Sandboxing/Testing134Inhibitors to Remediation 134MOUsSLAs134135Organizational Governance 135Business Process Interruption 135Degrading Functionality 135Ongoing Scanning and Continuous Monitoring 135Exam Preparation Tasks 136Review All Key Topics 136Define Key Terms 136Review Questions 137Chapter 6Analyzing Scan Output and Identifying Common Vulnerabilities 141“Do I Know This Already?” Quiz 141Foundation Topics 1439780789756954 BOOK.indb viii5/19/17 1:39 PM
ContentsixAnalyzing Output Resulting from a Vulnerability Scan 143Analyze Reports from a Vulnerability Scan 143Review and Interpret Scan Results 145Validate Results and Correlate Other Data Points 147Common Vulnerabilities Found in Targets Within an Organization 148Servers148Web Servers 149Database Servers 160Endpoints161Network Infrastructure 162Switches163MAC Overflow 164ARP Poisoning 164VLANs165Routers168Network Appliances 169Virtual Infrastructure 169Virtual Hosts 169Virtual Networks 170Management Interface 171Mobile Devices 173Interconnected Networks 174Virtual Private Networks 175Industrial Control Systems/SCADA Devices 179Exam Preparation Tasks 180Review All Key Topics 181Define Key Terms 182Review Questions 182Chapter 7Identifying Incident Impact and Assembling a Forensic Toolkit 187“Do I Know This Already?” Quiz 187Foundation Topics 189Threat Classification 189Known Threats vs. Unknown Threats 190Zero Day 190Advanced Persistent Threat 1919780789756954 BOOK.indb ix5/19/17 1:39 PM
xCompTIA Cybersecurity Analyst (CSA ) Cert GuideFactors Contributing to Incident Severity and Prioritization 191Scope of Impact 191Downtime and Recovery Time 191Data Integrity 193Economic193System Process Criticality 193Types of Data 194Personally Identifiable Information (PII) 194Personal Health Information (PHI) 195Payment Card Information 195Intellectual Property 197Corporate Confidential 199Forensics Kit 201Digital Forensics Workstation 202Forensic Investigation Suite 206Exam Preparation Tasks 208Review All Key Topics 208Define Key Terms 208Review Questions 209Chapter 8The Incident Response Process 213“Do I Know This Already?” Quiz 213Foundation Topics 216Stakeholders 216HRLegal216217Marketing217Management 217Purpose of Communication Processes 217Limit Communication to Trusted Parties 218Disclosure Based on Regulatory/Legislative Requirements 218Prevent Inadvertent Release of Information 218Secure Method of Communication 218Role-Based Responsibilities 218Technical219Management 2199780789756954 BOOK.indb x5/19/17 1:39 PM
ContentsxiLaw Enforcement 219Retain Incident Response Provider 220Using Common Symptoms to Select the Best Course of Action to SupportIncident Response 220Common Network-Related Symptoms 220Bandwidth Consumption 221Beaconing221Irregular Peer-to-Peer Communication 222Rogue Devices on the Network 223Scan Sweeps 224Unusual Traffic Spikes 225Common Host-Related Symptoms 225Processor Consumption 226Memory Consumption 227Drive Capacity Consumption 227Unauthorized Software 228Malicious Processes 229Unauthorized Changes 229Unauthorized Privileges 229Data Exfiltration 229Common Application-Related Symptoms 230Anomalous Activity 230Introduction of New Accounts 231Unexpected Output 231Unexpected Outbound Communication 231Service Interruption 231Memory Overflows 231Exam Preparation Tasks 232Review All Key Topics 232Define Key Terms 232Review Questions 233Chapter 9Incident Recovery and Post-Incident Response 237“Do I Know This Already?” Quiz 237Foundation Topics 2409780789756954 BOOK.indb xi5/19/17 1:39 PM
xiiCompTIA Cybersecurity Analyst (CSA ) Cert GuideContainment Techniques 240Segmentation240Isolation240Removal241Reverse Engineering 241Eradication Techniques 242Sanitization242Reconstruction/Reimage 242Secure Disposal 242Validation 243Patching 243Permissions 244Scanning244Verify Logging/Communication to Security Monitoring 244Corrective Actions 245Lessons Learned Report 245Change Control Process 245Update Incident Response Plan 245Incident Summary Report 246Exam Preparation Tasks 246Review All Key Topics 246Define Key Terms 247Review Questions 247Chapter 10Frameworks, Policies, Controls, and Procedures 251“Do I Know This Already?” Quiz 251Foundation Topics 254Regulatory Compliance 254Frameworks 258National Institute of Standards and Technology (NIST) 258Framework for Improving Critical Infrastructure Cybersecurity 259ISO260Control Objectives for Information and Related Technology(COBIT) 263Sherwood Applied Business Security Architecture (SABSA) 265The Open Group Architecture Framework (TOGAF) 265Information Technology Infrastructure Library (ITIL) 2679780789756954 BOOK.indb xii5/19/17 1:39 PM
ContentsPoliciesxiii268Password Policy 268Acceptable Use Policy (AUP) 271Data Ownership Policy 272Data Retention Policy 272Account Management Policy 273Data Classification Policy 274Sensitivity and Criticality 275Commercial Business Classifications 276Military and Government Classifications 276Controls277Control Selection Based on Criteria 278Handling Risk 278Organizationally Defined Parameters 281Access Control Types 282Procedures284Continuous Monitoring 284Evidence Production 285Patching 285Compensating Control Development 286Control Testing Procedures 286Manage Exceptions 287Remediation Plans 287Verifications and Quality Control 288Audits288Evaluations290Assessments290Maturity Model 291CMMI291Certification291NIACAP292ISO/IEC 27001 292ISO/IEC 27002 294Exam Preparation Tasks 294Review All Key Topics 2949780789756954 BOOK.indb xiii5/19/17 1:39 PM
xivCompTIA Cybersecurity Analyst (CSA ) Cert GuideDefine Key Terms 295Review Questions 296Chapter 11Remediating Security Issues Related to Identity and AccessManagement 301“Do I Know This Already?” Quiz 301Foundation Topics 304Security Issues Associated with Context-Based Authentication 304Time304Location 304Frequency305Behavioral 305Security Issues Associated with Identities 305Personnel306Employment Candidate Screening 306Employment Agreement and Policies 308Periodic Review 308Proper Credential Management 308Creating Accountability 309Maintaining a Secure Provisioning Life Cycle 309Endpoints310Social Engineering Threats 310Malicious Software 311Rogue Endpoints 311Rogue Access Points 312Servers312ServicesRoles313315Applications316IAM Software 316Applications as Identities 317OAuth318OpenSSL319Security Issues Associated with Identity Repositories 319Directory Services 319LDAP319Active Directory (AD) 3209780789756954 BOOK.indb xiv5/19/17 1:39 PM
ContentsSESAMEDNSxv321322TACACS and RADIUS 323Security Issues Associated with Federation and Single Sign-on 325Identity Propagation ibboleth332Manual vs. Automatic Provisioning/Deprovisioning 333Self-Service Password Reset 334Exploits 334Impersonation334Man-in-the-Middle 334Session Hijack 335Cross-Site Scripting 335Privilege Escalation 335Rootkit335Exam Preparation Tasks 336Review All Key Topics 336Define Key Terms 337Review Questions 338Chapter 12Security Architecture and Implementing CompensatingControls 343“Do I Know This Already?” Quiz 343Foundation Topics 346Security Data Analytics 346Data Aggregation and Correlation 346Trend Analysis 346Historical Analysis 347Manual Review 348Firewall Log 348Syslogs9780789756954 BOOK.indb xv3505/19/17 1:39 PM
xviCompTIA Cybersecurity Analyst (CSA ) Cert GuideAuthentication Logs 351Event Logs 352Defense in Depth 353Personnel354Training354Dual Control 355Separation of Duties 355Split Knowledge 355Third Party/Consultants 355Cross-Training/Mandatory Vacations 356Succession Planning 356Processes 356Continual Improvement 356Scheduled Reviews/Retirement of Processes 357Technologies358Automated Reporting 358Security Appliances 358Security Suites 359OutsourcingCryptography360362Other Security Concepts 373Network Design 374Exam Preparation Tasks 379Review All Key Topics 379Define Key Terms 380Review Questions 380Chapter 13Application Security Best Practices 385“Do I Know This Already?” Quiz 385Foundation Topics 387Best Practices During Software Development 387Plan/Initiate Project 387Gather Requirements (Security Requirements Definition) 388DesignDevelop9780789756954 BOOK.indb xvi3883895/19/17 1:39 PM
ContentsxviiTest/Validate 389Security Testing Phases 390Static Code Analysis 390Web App Vulnerability Scanning 391Fuzzing391Use Interception Proxy to Crawl Application 392Manual Peer Reviews 393User Acceptance Testing 393Stress Test Application 393Security Regression Testing 394Input Validation 394Release/Maintain395Certify/Accredit 395Change Management and Configuration Management/Replacement 395Secure Coding Best Practices 396OWASPSANS396396Center for Internet Security 397System Design Recommendations 397Benchmarks398Exam Preparation Tasks 398Review All Key Topics 398Define Key Terms 399Review Questions 399Chapter 14Using Cybersecurity Tools and Technologies 403“Do I Know This Already?” Quiz 403Foundation Topics 405Preventative Tools 405IPS405IDS405SourcefireSnortBro9780789756954 BOOK.indb xvii4054064075/19/17 1:39 PM
xviiiCompTIA Cybersecurity Analyst (CSA ) Cert GuideHIPS408Firewall408Firewall Architecture 410Cisco415Palo Alto 415Check Point 415Antivirus415Anti-malware 416Anti-spyware416Cloud Antivirus Services 417EMET418Web Proxy 418Web Application Firewall 418ModSecurity420NAXSI420Imperva421Collective Tools OSSIM422Kiwi Syslog 423Network Scanning 423Nmap423Vulnerability Scanning 423Qualys425Nessus425OpenVAS 426Nexpose 426Nikto427Microsoft Baseline Security Analyzer 427Packet Capture 428Wireshark428tcpdump 4299780789756954 BOOK.indb xviii5/19/17 1:39 PM
ContentsxixNetwork General 429Aircrack-ng429Command Line/IP Utilities 430Netstat 430ping431tracert/traceroute432ipconfig/ifconfig 433nslookup/dig 434SysinternalsOpenSSLIDS/HIDS435436436Analytical Tools 436Vulnerability Scanning 437Monitoring Tools 437MRTGNagios437438SolarWindsCacti438439NetFlow Analyzer 439Interception Proxy 439Burp Suite 440Zap440Vega 440Exploit Tools 440Interception Proxy 440Exploit Framework 441Metasploit441Nexpose 442Fuzzers 442Untidy/Peach Fuzzer 442Microsoft SDL File/Regex Fuzzer 442Forensics Tools 443Forensic Suites 443EnCaseFTK9780789756954 BOOK.indb xix4444445/19/17 1:39 PM
xxCompTIA Cybersecurity Analyst (CSA ) Cert 5MD5sum445SHAsum445Password Cracking 445John the Ripper 445Cain & Abel 446Imaging447DD447Exam Preparation Tasks 447Review All Key Topics 447Define Key Terms 448Review Questions 448Chapter 15Final Preparation 453Tools for Final Preparation 453Pearson Test Prep Practice Test Software and Questions on theWebsite 453Accessing the Pearson Test Prep Software Online 454Accessing the Pearson Test Prep Practice Test Software Offline 454Customizing Your Exams 455Updating Your Exams 456Premium Edition 456Chapter-Ending Review Tools 457Suggested Plan for Final Review/Study 457Summary457Appendix A Answers to the “Do I Know This Already?” Quizzes and ReviewQuestions 459Glossary 491Index 5269780789756954 BOOK.indb xx5/19/17 1:39 PM
About the AuthorxxiAbout the AuthorTroy McMillan is a product developer and technical editor for Kaplan IT as wellas a full-time trainer. He became a professional trainer 16 years ago, teaching Cisco,Microsoft, CompTIA, and wireless classes. He has written or contributed to morethan a dozen projects, including the following recent ones: Contributing subject matter expert for CCNA Cisco Certified NetworkAssociate Certification Exam Preparation Guide (Kaplan) Author of CISSP Cert Guide (Pearson) Prep test question writer for CCNA Wireless 640-722 (Cisco Press) Author of CASP Cert Guide (Pearson)Troy has also appeared in the following training videos for OnCourse Learning:Security ; Network ; Microsoft 70-410, 411, and 412 exam prep; ICND1; andICND2.He delivers CISSP training classes for CyberVista, authorized online training provider for (ISC)2.Troy now creates certification practice tests and study guides for the Transcenderand Self-Test brands. He lives in Pfafftown, North Carolina, with his wife, Heike.9780789756954 BOOK.indb xxi5/19/17 1:39 PM
xxiiCompTIA Cybersecurity Analyst (CSA ) Cert GuideDedicationI dedicate this book to my wife, Heike, who has supported me every time I’ve reinvented myself.9780789756954 BOOK.indb xxii5/19/17 1:39 PM
AcknowledgmentsxxiiiAcknowledgmentsI must thank everyone on the Pearson team for all of their help in making thisbook better than it would have been without their help. That includes MichelleNewcomb, Eleanor Bru, Chris Crayton, and Robin Abernathy.9780789756954 BOOK.indb xxiii5/19/17 1:39 PM
xxivCompTIA Cybersecurity Analyst (CSA ) Cert GuideAbout the Technical ReviewersChris Crayton, MCSE, is an author, a technical consultant, and a trainer. He hasworked as a computer technology and networking instructor, information securitydirector, network administrator, network engineer, and PC specialist. Chris hasauthored several print and online books on PC repair, CompTIA A , CompTIASecurity , and Microsoft Windows. He has also served as technical editor and content contributor on numerous technical titles for several leading publishing companies. He holds numerous industry certifications, has been recognized with manyprofessional teaching awards, and has served as a state-level SkillsUSA competitionjudge.Robin M. Abernathy has been working in the IT certification preparation industry at Kaplan IT Certification Preparation, the owners of the Transcender and SelfTest brands, for more than a decade. Robin has written and edited certificationpreparation materials for many (ISC)2, Microsoft, CompTIA, PMI, Cisco, and ITILcertifications and holds multiple IT certifications from these vendors.Robin provides training on computer hardware and software, networking, security,and project management. Over the past couple years, she has ventured into the traditional publishing industry, technical editing several publications and coauthoringPearson’s CISSP Cert Guide and CASP Cert Guide. She presents at technical conferences and hosts webinars on IT certification topics.9780789756954 BOOK.indb xxiv5/19/17 1:39 PM
Reader ServicesxxvWe Want to Hear from You!As the reader of this book, you are our most important critic and commentator. Wevalue your opinion and want to know what we’re doing right, what we could do better, what areas you’d like to see us publish in, and any other words of wisdom you’rewilling to pass our way.We welcome your comments. You can e-mail or write to let us know what you didor didn’t like about this book—as well as what we can do to make our books better.Please note that we cannot help you with technical problems related to the topic of this book.When you write, please be sure to include this book’s title and author as well as yourname and e-mail address. We will carefully review your comments and share themwith the author and editors who worked on the book.E-mail: feedback@pearsonitcertification.comMail:Pearson IT CertificationATTN: Reader Feedback800 East 96th StreetIndianapolis, IN 46240 USAReader ServicesRegister your copy of CompTIA Cybersecurity Analyst (CSA ) Cert Guide atwww.pearsonitcertification.com for convenient access to downloads, updates, andcorrections as they become available. To start the registration process, go towww.pearsonitcertification.com/register and log in or create an account*. Enter theproduct ISBN 9780789756954 and click Submit. When the process is complete, youwill find any available bonus content under Registered Products.*Be sure to check the box that you would like to hear from us to receive exclusivediscounts on future editions of this product.9780789756954 BOOK.indb xxv5/19/17 1:39 PM
Becoming aCompTIA CertifiedIT Professional is EasyIt’s also the best way to reach greaterprofessional opportunities and rewards.Why Get CompTIA Certified?Growing DemandHigher SalariesVerified StrengthsUniversal SkillsLabor estimates predictsome technology fields willexperience growth of over 20%by the year 2020.* CompTIAcertification qualifies the skillsrequired to join this workforce.IT professionals withcertifications on their resumecommand better jobs, earnhigher salaries and have moredoors open to new multiindustry opportunities.91% of hiring managersindicate CompTIA certificationsare valuable in validating ITexpertise, making certificationthe best way to demonstrateyour competency andknowledge to employers.**CompTIA certifications arevendor neutral—which meansthat certified professionalscan proficiently work withan extensive variety ofhardware and software foundin most organizations.LearnCertifyLearn more about whatthe exam covers byreviewing the following:Purchase a voucher at aPearson VUE testing centeror at CompTIAstore.com. Exam objectives forkey study points. Register for your exam at aPearson VUE testing center: Sample questions for a generaloverview of what to expecton the exam and examplesof question format. Visit pearsonvue.com/CompTIA tofind the closest testing center to you. Visit online forums, like LinkedIn,to see what other IT professionalssay about CompTIA exams.WorkCongratulations on yourCompTIA certification! Make sure to add yourcertification to your resume. Check out the CompTIACertification Roadmap to planyour next career move. Schedule the exam online. You willbe required to enter your vouchernumber or provide paymentinformation at registration. Take your certification exam.Learn more: Certification.CompTIA.org/networkplus* Source: CompTIA 9th Annual Information Security Trends study: 500 U.S. IT and Business Executives Responsible for Security** Source: CompTIA Employer Perceptions of IT Training and Certification*** Source: 2013 IT Skills and Salary Report by CompTIA Authorized Partner 2014 CompTIA Properties, LLC, used under license by CompTIA Certifications, LLC. All rights reserved. All certification programs and education related to such programs are operated exclusively byCompTIA Certifications, LLC. CompTIA is a registered trademark of CompTIA Properties, LLC in the U.S. and internationally. Other brands and company names mentioned herein may be trademarks or servicemarks of CompTIA Properties, LLC or of their respective owners. Reproduction or dissemination prohibited without written consent of CompTIA Properties, LLC. Printed in the U.S. 01085-Sep20149780789756954 BOOK.indb xxvi5/19/17 1:39 PM
IntroductionxxviiIntroductionCompTIA CSA bridges the skills gap between CompTIA Security and CompTIAAdvanced Security Practitioner (CASP). Building on CSA , IT professionals canpursue CASP to prove their mastery of the hands-on cybersecurity skills required atthe 5- to 10-year experience level. Earn the CSA certification to grow your careerwithin the CompTIA recommended cybersecurity career pathway.CompTIA CSA certification is designed to be a “vendor-neutral” exam that measures your knowledge of industry-standard technology.Goals and MethodsThe number-one goal of this book is a simple one: to help you pass the 2017 versionof the CompTIA CSA certification exam CS0-001.Because the CompTIA CSA certification exam stresses problem-solving abilitiesand reasoning more than memorization of terms and facts, our goal is to help youmaster and understand the required objectives for each exam.To aid you in mastering and understanding the CSA certification objectives, thisbook uses the following methods: The beginning of each chapter defines the topics to be covered in the chapter;it also lists the corresponding CompTIA CSA objectives. The body of the chapter explains the topics from a hands-on and theory-basedstandpoint. This includes in-depth descriptions, tables, and figures that aregeared toward building your knowledge so that you can pass the exam. Thechapters are broken down into several topics each. The key topics indicate important figures, tables, and lists of information thatyou should know for the exam. They are interspersed throughout the chapterand are listed in a table at the end of the chapter. Key terms without definitions are listed at the end of each chapter. Writedown the definition of each term and check your work against the completekey terms in the glossary.Who Should Read This Book?The CompTIA CSA examination is designed for IT security analysts, vulnerability analysts, and threat intelligence analysts. The exam certifies that a successfulcandidate has the knowledge and skills required to configure and use threat detection tools, perform data analysis, and interpret the results to identify vulnerabilities,9780789756954 BOOK.indb xxvii5/19/17 1:39 PM
xxviiiCompTIA Cybersecurity Analyst (CSA ) Cert Guidethreats, and risks to an organization, with the end goal of securing and protectingapplications and systems in an organization.The recommended experience for taking the CompTIA CSA exam includesNetwork , Security , or equivalent knowledge as well as a minimum of three orfour years of hands-on information security or related experience. While there is norequired prerequisite, CSA is intended to follow CompTIA Security or equivalentexperience and has a technical, hands-on focus.This book is for you if you are attempting to attain a position in the cybersecurityfield. It is also for you if you want to keep your skills sharp or perhaps retain yourjob due to a company policy that mandates that you update security skills.This book is also for you if you want to acquire additional certifications beyondSecurity . The book is designed to offer easy transition to future certificationstudies.Strategies for Exam PreparationStrategies for exam preparation vary depending on your existing skills, knowledge,and equipment available. Of course, the ideal exam preparation would consist ofthree or four years of hands-on security or related experience followed by rigorousstudy of the exam objectives.After you have read through the book, have a look at the current exam objectives forthe CompTIA CSA Certification Exams, listed at ybersecurity-analyst#tab4. If there are any areas shown in the certification exam outline that you would still like to study, find those sections in the bookand review them.When you feel confident in your skills, attempt the practice exams found on thewebsite that accompanies this book. As you work through the practice exam, notethe areas where you lack confidence and review those concepts or configurations inthe book. After you ha
800 East 96th Street Indianapolis, Indiana 46240 USA CompTIA Cybersecurity Analyst (CSA ) Cert Guide
