Skip to main content
Ace Skills Consulting
CompTIA logoIntermediate

CS0-003: CompTIA CySA+

Detect, analyse and respond to threats like a SOC analyst — and prepare for the CompTIA CySA+ CS0-003 exam.

  • 40 hours of live, analyst-focused training
  • SIEM, log and packet analysis labs
  • Vulnerability scanning and prioritisation exercises
  • Incident response simulations
  • Mapped to the four CS0-003 domains
Aligned to CompTIA exam CS0-003
Duration
5 Days | 40 Hrs
Next batch
Batches on request
Delivery
Live Online · Onsite · Corporate
Level
Intermediate
Exam
CS0-003
Language
English

Why learn CS0-003 with Ace Skills

  • Think like a SOC analyst

    Practise triage and investigation with realistic alerts and datasets.

  • Prioritise what matters

    Learn to rank vulnerabilities and incidents by real business risk.

  • Hands-on analysis

    Work with SIEM, packet captures and endpoint data in every module.

  • Next step after Security+

    An intermediate certification focused on defensive, analyst-level skills.

Course overview

Security analysts spend their days making sense of signals: alerts from a SIEM, results from a vulnerability scan, an odd process on a server or a suspicious login. The skill is in deciding quickly what matters and what to do next. This five-day course builds that analytical skill through hands-on investigation work and prepares you for the CySA+ CS0-003 exam.

Days one and two cover security operations. You will study system and network architecture from a defender’s viewpoint, analyse indicators of compromise in logs, endpoint data, network traffic and email, and use threat intelligence and threat hunting techniques. You will also look at how automation and orchestration support a modern security operations centre.

Day three focuses on vulnerability management: running and tuning scans, interpreting results, prioritising with risk context and recommending controls, including for cloud and application vulnerabilities. Day four covers incident response and management, using established frameworks for detection, containment, eradication and recovery, with attack frameworks such as MITRE ATT&CK to structure analysis. Day five covers reporting and communication — metrics, stakeholder reporting and lessons learned — and an exam-readiness session.

Labs use realistic datasets so that you practise the investigation process, not just the theory. This course is aligned to the CS0-003 exam and prepares you for it; CompTIA updates its exams periodically, so confirm the current version on the CompTIA website before booking.

Key features

  • Investigation labs with realistic log and packet data
  • SIEM queries and alert triage
  • Vulnerability scan tuning and prioritisation
  • MITRE ATT&CK-based incident analysis
  • Report writing exercises for stakeholders
  • Performance-based question practice
  • Course completion certificate from Ace Skills Consulting

Who should attend

  • Security and SOC analysts
  • Security+ holders moving into analyst roles
  • Threat intelligence and vulnerability management staff
  • Incident responders
  • System administrators with security responsibilities

Prerequisites

  • Security+ or equivalent knowledge
  • Hands-on IT or security experience (around three to four years is commonly recommended)
  • Comfort with Windows and Linux command lines

Curriculum

5 Days · 40 Hours · 15 Modules · 8 Labs

  1. Architecture for defenders

    • Logging and log ingestion
    • Operating system and network concepts for analysts
    • Identity and access in investigations
    • Cloud and hybrid visibility

    Indicators of malicious activity

    • Network indicators
    • Host and endpoint indicators
    • Application indicators
    • Email and social engineering indicators
    • Lab: Hunt for indicators in Windows event logs · 50 min

    Packet analysis

    • Reading packet captures
    • Identifying beaconing and exfiltration
    • Protocol anomalies
    • Lab: Analyse a packet capture of a suspected compromise · 45 min

  2. Analysis tools

    • SIEM and SOAR
    • EDR and XDR
    • Sandboxing and file analysis
    • Scripting for analysts
    • Lab: Write SIEM queries to triage a set of alerts · 50 min

    Threat intelligence and hunting

    • Intelligence sources and confidence
    • Threat actor profiling
    • Hypothesis-driven threat hunting
    • Sharing intelligence
    • Lab: Run a threat hunt using an intelligence report · 40 min

    Process improvement

    • Standardising processes
    • Automation opportunities
    • Single pane of glass

  3. Scanning

    • Asset discovery
    • Credentialed and non-credentialed scans
    • Agent-based and agentless scanning
    • Special considerations for OT and cloud
    • Lab: Configure and run authenticated vulnerability scans · 50 min

    Analysis and prioritisation

    • CVSS and context
    • Validating findings and false positives
    • Common web and application vulnerabilities
    • Attack surface management
    • Lab: Prioritise scan results for a remediation plan · 40 min

    Controls and remediation

    • Compensating controls
    • Patching and configuration management
    • Exceptions and risk acceptance

  4. Frameworks

    • Incident response life cycle
    • MITRE ATT&CK and the Diamond Model
    • Cyber kill chain

    Detection and analysis

    • Scoping an incident
    • Evidence acquisition and chain of custody
    • Root cause analysis
    • Lab: Respond to a simulated intrusion end to end · 75 min

    Containment and recovery

    • Containment strategies
    • Eradication and recovery
    • Post-incident activities

  5. Vulnerability reporting

    • Reporting to technical and business audiences
    • Metrics and key performance indicators
    • Stakeholder communication
    • Lab: Write an executive summary for a vulnerability assessment · 35 min

    Incident reporting

    • Incident declaration and escalation
    • Regulatory and legal communication
    • Lessons learned

    Exam readiness

    • Performance-based question strategy
    • Full-length practice test
    • Domain review
Download full syllabus (PDF)

Skills you will gain

  • Security operations
  • Log analysis
  • Packet analysis
  • SIEM
  • EDR
  • Threat intelligence
  • Threat hunting
  • Vulnerability management
  • Incident response
  • MITRE ATT&CK
  • Security reporting

Tools & technologies

  • Wireshark
  • Splunk
  • Wazuh
  • Nmap
  • OpenVAS
  • Sysinternals
  • Kali Linux
  • CyberChef

Certification exam

Exam details
Exam nameCompTIA CySA+
Exam codeCS0-003
Number of questionsMaximum 85
Duration165 minutes
Passing score750 (on a scale of 100–900)
Voucher includedNo — book directly with the vendor
Question formatMultiple choice, Multiple response, Performance-based lab
DeliveryOnline proctored or Test centre
Validity & renewal3 years (renewable through CompTIA continuing education)

Skill areas measured

  1. Security Operations
  2. Vulnerability Management
  3. Incident Response and Management
  4. Reporting and Communication

Exam details are pending verification. Vendors change exams; confirm on the official vendor page before booking. Official exam page (opens in a new tab)

Schedule & Pricing

Live Online

Individual

Price on request

  • 40 hours of live, trainer-led sessions
  • 8 hands-on labs
  • Ace Skills course completion certificate

Onsite

At your office or our centre

Pricing depends on location, group size and dates.

  • Delivered at your premises or an Ace centre
  • Same curriculum and labs as live online
  • Dates planned around your team

Corporate / Team

Private batch for your organisation

A private batch with content adapted to your environment and goals.

  • Customised curriculum
  • Private batch, online or onsite
  • Progress and assessment reports
  • GST invoice and PO-based billing

No public batches scheduled — Talk to an Advisor for a private batch.

Projects & labs you will build

  • Day 1 · 45 min

    Analyse a packet capture of a suspected compromise

  • Day 4 · 75 min

    Respond to a simulated intrusion end to end

Your certificate

Certificate of Completion — Ace Skills Consulting

Awarded on completing the course. It records the course title and training hours, and you can share it on your LinkedIn profile.

The CompTIA certification itself is awarded by CompTIA when you pass exam CS0-003.

Frequently asked questions

Is CS0-003 the current CySA+ exam?

The course is mapped to CS0-003. CompTIA refreshes exams periodically, so confirm the current version on the CompTIA website before booking.

Do I need Security+ first?

It is not mandatory, but Security+ level knowledge is assumed throughout the course.

Will I use a real SIEM?

Yes. Labs use open-source and trial tools with prepared datasets so that you can practise real investigations.

Is this course useful for SOC teams?

Yes. It mirrors day-to-day analyst work and can be tailored to your SOC’s tooling in a private batch.

How long is CySA+ valid?

Three years, renewable through CompTIA’s continuing education programme.

Related courses

Explore more

All Cybersecurity courses CompTIA certifications

CompTIA, A+, Network+, Security+, CySA+, PenTest+, SecurityX, Cloud+ and Linux+ are trademarks of CompTIA, Inc.

Train your team on CS0-003

Private batches online or at your office in India and the GCC, with a curriculum adapted to your environment.