CompTIA CySA+ Study Guide, 3rd Edition

Chapter 10Incident Detection and Analysis

THE COMPTIA CYBERSECURITY ANALYST (CYSA+) EXAM OBJECTIVES COVERED IN THIS CHAPTER INCLUDE:

• Domain 3.0 Incident Response and Management
  • 3.2 Given a scenario, perform incident response activities
    • Detection and analysis

Responding to security incidents and network events is a common task for cybersecurity analysts, and to do so, you need to know how to detect and analyze indicators of compromise (IoCs), to acquire evidence, and to preserve it. Network-based IoCs such as excessive or suspicious bandwidth consumption, probes and scans, and rogue devices are all likely to be encountered by security professionals, and knowing how to identify and understand them is critical for security practitioners. ...