Appendix A

Lesson Description

Mapping Course Content to CompTIA Cybersecurity

Analyst (CySA+) Exam CS0-002
Domain and Objective Covered in
1.0 Thread and Vulnerability Management
1.1 Explain the importance of threat data and intelligence Lesson 1, Topic B
Lesson 2, Topic A
Lesson 2, Topic B
Intelligence sources Lesson 1, Topic B
Open-source intelligence Lesson 1, Topic B
Proprietary/closed-source intelligence Lesson 1, Topic B
Timeliness Lesson 1, Topic B
Relevancy Lesson 1, Topic B
Accuracy Lesson 1, Topic B
Confidence Levels Lesson 1, Topic B
Indicator management Lesson 2, Topic B
Structured Threat Information eXpression (STIX) Lesson 2, Topic B
Trusted Automated eXchange of Indicator Information (TAXII)Lesson 2, Topic B
OpenIOC Lesson 2, Topic B
Threat Classification Lesson 2, Topic A
Known threat vs. unknown threat Lesson 2, Topic A
Zero-day Lesson 2, Topic A
Advanced persistent threat Lesson 2, Topic A
Threat Actors Lesson 2, Topic A
Nation-state Lesson 2, Topic A
Hacktivist Lesson 2, Topic A
Organized crime Lesson 2, Topic A
Insider Threat - intentional Lesson 2, Topic A
Insider Threat - unintentional Lesson 2, Topic A
Intelligence cycle Lesson 1, Topic B
Requirements Lesson 1, Topic B
Collection Lesson 1, Topic B
Analysis Lesson 1, Topic B
Dissemination Lesson 1, Topic B
Feedback Lesson 1, Topic B
Commodity malware Lesson 2, Topic A

Appendix_A_pp_01-15.indd 1 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Information sharing and analysis communities Lesson 1, Topic B
Healthcare Lesson 1, Topic B
Financial Lesson 1, Topic B
Aviation Lesson 1, Topic B
Government Lesson 1, Topic B
Critical Infrastructure Lesson 1, Topic B
1.2 Given a scenario, utilize threat intelligence to support or-Lesson 1, Topic B
ganizational security. Lesson 2, Topic B
Lesson 2, Topic C
Lesson 8, Topic C
Attack frameworks Lesson 2, Topic B
MITRE ATT&CK Lesson 2, Topic B
The Diamond Model of Intrusion Analysis Lesson 2, Topic B
Kill chain Lesson 2, Topic B
Threat research Lesson 2, Topic B
Reputational Lesson 2, Topic B
Behavioral Lesson 2, Topic B
Indicator of compromise (IOC) Lesson 2, Topic B
Common vulnerability scoring system (CVSS) Lesson 8, Topic C
Threat modeling methodologies Lesson 2, Topic C
Adversary capability Lesson 2, Topic C
Total attack surface Lesson 2, Topic C
Attack vector Lesson 2, Topic C
Impact Lesson 2, Topic C
Likelihood Lesson 2, Topic C
Threat intelligence sharing with supported functions Lesson 1, Topic B
Incident response Lesson 1, Topic B
Vulnerability management Lesson 1, Topic B
Risk management Lesson 1, Topic B
Security engineering Lesson 1, Topic B
Detection and monitoring Lesson 1, Topic B
1.3 Given a scenario, perform vulnerability management ac-
tivities
Vulnerability identification Lesson 8, Topic B
Asset criticality Lesson 8, Topic B
Active vs. passive scanning Lesson 8, Topic B
Mapping/enumeration Lesson 8, Topic A
Validation Lesson 8, Topic C
True positive Lesson 8, Topic C
False positive Lesson 8, Topic C
True negative Lesson 8, Topic C
False negative Lesson 8, Topic C

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 2 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Remediation/mitigation Lesson 8, Topic D
Configuration baseline Lesson 8, Topic D
Patching Lesson 6, Topic C
Hardening Lesson 6, Topic C
Compensating controls Lesson 7, Topic A
Risk acceptance Lesson 7, Topic A
Verification of mitigation Lesson 8, Topic D
Scanning parameters and criteria Lesson 8, Topic B
Risks associated with scanning activities Lesson 8, Topic B
Vulnerability feed Lesson 8, Topic B
Scope Lesson 8, Topic B
Credentialed vs non-credentialed Lesson 8, Topic B
Server-based vs agent-based Lesson 8, Topic B
Internal vs external Lesson 8, Topic B
Special considerations Lesson 8, Topic B
Types of data Lesson 8, Topic B
Technical constraints Lesson 8, Topic B
Workflow Lesson 8, Topic B
Sensitivity levels Lesson 8, Topic B
Regulatory requirements Lesson 8, Topic B
Segmentation Lesson 8, Topic B
Intrusion prevention system (IPS), intrusion detectionLesson 8, Topic B
system (IDS), and firewall settings
Inhibitors to remediation Lesson 8, Topic D
Memorandum of understanding (MOU) Lesson 8, Topic D
Service-level agreement (SLA) Lesson 8, Topic D
Organizational governance Lesson 8, Topic D
Business process interruption Lesson 8, Topic D
Degrading functionality Lesson 8, Topic D
Legacy systems Lesson 8, Topic D
Proprietary systems Lesson 8, Topic D
1.4 Given a scenario, analyze the output from common vulne-Lesson 8, Topic A
rability assessment tools Lesson 8, Topic B
Lesson 8, Topic C
Lesson 11, Topic C
Lesson 12, Topic C
Web application scanner Lesson 11, Topic C
OWASP Zed Attack Proxy (ZAP) Lesson 11, Topic C
Burp suite Lesson 11, Topic C
Nikto Lesson 11, Topic C
Arachni Lesson 11, Topic C
Infrastructure vulnerability scanner Lesson 8, Topic B

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 3 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Nessus Lesson 8, Topic C
OpenVAS Lesson 8, Topic C
Qualys Lesson 8, Topic C
Software assessment tools and techniques Lesson 11, Topic C
Static analysis Lesson 11, Topic C
Dynamic analysis Lesson 11, Topic C
Reverse engineering Lesson 11, Topic C
Fuzzing Lesson 11, Topic C
Enumeration Lesson 8, Topic A
Nmap Lesson 8, Topic A
hping Lesson 8, Topic A
Active vs passive Lesson 8, Topic A
Responder Lesson 8, Topic A
Wireless assessment tools Lesson 8, Topic A
Aircrack-ng Lesson 8, Topic A
Reaver Lesson 8, Topic A
oclHashcat Lesson 8, Topic A
Cloud infrastructure assessment tools Lesson 12, Topic C
ScoutSuite Lesson 12, Topic C
Prowler Lesson 12, Topic C
Pacu Lesson 12, Topic C
1.5 Explain the threats and vulnerabilities associated withLesson 9, Topic D
specialized technology
Mobile Lesson 9, Topic D
Internet of Things (IoT) Lesson 9, Topic D
Embedded Lesson 9, Topic D
Real-time operating system (RTOS) Lesson 9, Topic D
System-on-Chip (SoC) Lesson 9, Topic D
Field programmable gate array (FPGA) Lesson 9, Topic D
Physical access control Lesson 9, Topic D
Building automation systems Lesson 9, Topic D
Vehicles and drones Lesson 9, Topic D
CAN bus Lesson 9, Topic D
Workflow and process automation systems Lesson9, Topic D
Industrial control system Lesson 9, Topic D
Supervisory control and data acquisition (SCADA) Lesson 9, Topic D
Modbus Lesson 9, Topic D
1.6 Explain the threats and vulnerabilities associated withLesson 12, Topic A
operating in the cloud Lesson 12, Topic C
Lesson 12, Topic D
Cloud service models Lesson 12, Topic A
Software as a Service (SaaS) Lesson 12, Topic A

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 4 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Platform as a Service (PaaS) Lesson 12, Topic A
Infrastructure as a Service (IaaS) Lesson 12, Topic A
Cloud deployment models Lesson 12, Topic A
Public Lesson 12, Topic A
Private Lesson 12, Topic A
Community Lesson 12, Topic A
Hybrid Lesson 12, Topic A
Function as a Service (FaaS)/serverless architecture Lesson 12, Topic A
Infrastructure as code (IaC) Lesson 12, Topic D
Insecure application programming interface (API) Lesson 12, Topic C
Improper key management Lesson 12, Topic C
Unprotected storage Lesson 12, Topic C
Logging and monitoring Lesson 12, Topic C
Insufficient logging and monitoring Lesson 12, Topic C
Inability to access Lesson 12, Topic C
1.7 Given a scenario, implement controls to mitigate attacksLesson 11, Topic A
and software vulnerabilities Lesson 11, Topic B
Attack types Lesson 11, Topic A
Lesson 11, Topic B
Extensible markup language (XML) attack Lesson 11, Topic B
Structured query language (SQL) injection Lesson 11, Topic B
Overflow attack Lesson 11, Topic A
Buffer Lesson 11, Topic A
Integer Lesson 11, Topic A
Heap Lesson 11, Topic A
Remote code execution Lesson 11, Topic A
Directory traversal Lesson 11, Topic B
Privilege escalation Lesson 11, Topic A
Password spraying Lesson 11, Topic B
Credential stuffing Lesson 11, Topic B
Impersonation Lesson 11, Topic B
Man-in-the-middle attack Lesson 11, Topic B
Session hijacking Lesson 11, Topic B
Rootkit Lesson 11, Topic A
Cross-site scripting Lesson 11, Topic B
Reflected Lesson 11, Topic B
Persistent Lesson 11, Topic B
Document object model (DOM) Lesson 11, Topic B
Vulnerabilities Lesson 11, Topic A
Lesson 11, Topic B
Improper error handling Lesson 11, Topic A
Dereferencing Lesson 11, Topic A

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 5 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Insecure object reference Lesson 11, Topic B
Race condition Lesson 11, Topic A
Broken authentication Lesson 11, Topic B
Sensitive data exposure Lesson 11, Topic B
Insecure components Lesson 11, Topic A
Insufficient logging and monitoring Lesson 11, Topic A
Weak or default configurations Lesson 11, Topic A
Use of insecure functions Lesson 11, Topic A
strcpy Lesson 11, Topic A
2.0 Software and Systems Security
2.1 Given a scenario, apply security solutions for infrastruc-Lesson 9, Topic A
ture management Lesson 9, Topic B
Lesson 10, Topic B
Lesson 12, Topic A
Cloud vs on-premises Lesson 12, Topic A
Asset management Lesson 9, Topic B
Asset tagging Lesson 9, Topic B
Segmentation Lesson 9, Topic B
Physical Lesson 9, Topic B
Virtual Lesson 9, Topic B
Jumpbox Lesson 9, Topic B
System isolation Lesson 9, Topic B
Air gap Lesson 9, Topic B
Network architecture Lesson 9, Topic B
Physical Lesson 9, Topic B
Software-defined Lesson 9, Topic B
Virtual private cloud (VPC) Lesson 12, Topic A
Virtual private network (VPN) Lesson 9, Topic B
Serverless Lesson 10, Topic B
Change management Lesson 9, Topic B
Virtualization Lesson 9, Topic B
Virtual desktop infrastructure (VDI) Lesson 9, Topic B
Containerization Lesson 9, Topic B
Identity and access management Lesson 9, Topic A
Privilege management Lesson 9, Topic A
Multifactor authentication (MFA) Lesson 9, Topic A
Single sign-on (SSO) Lesson 9, Topic A
Federation Lesson 9, Topic A
Role-based Lesson 9, Topic A
Attribute-based Lesson 9, Topic A
Mandatory Lesson 9, Topic A
Manual review Lesson 9, Topic A

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 6 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Cloud access security broker (CASB) Lesson 12, Topic A
Honeypot Lesson 9, Topic B
Monitoring and logging Lesson 9, Topic A
Encryption Lesson 10, Topic B
Certificate management Lesson 9, Topic A
Active defense Lesson 9, Topic B
2.2 Explain software assurance best practices Lesson 11, Topic A
Lesson 11, Topic B
Lesson 11, Topic C
Lesson 12, Topic B
Lesson 12, Topic D
Platforms Lesson 11, Topic A
Mobile Lesson 11, Topic A
Web application Lesson 11, Topic A
Client/server Lesson 11, Topic A
Embedded Lesson 11, Topic A
System-on-chip (SoC) Lesson 11, Topic A
Firmware Lesson 11, Topic A
Software development life cycle (SDLC) integration Lesson 11, Topic A
DevSecOps Lesson 12, Topic D
Software assessment methods Lesson 11, Topic C
User acceptance testing Lesson 11, Topic C
Stress test application Lesson 11, Topic C
Security regression testing Lesson 11, Topic C
Code review Lesson 11, Topic C
Secure coding best practices Lesson 11, Topic B
Input validation Lesson 11, Topic B
Output encoding Lesson 11, Topic B
Data protection Lesson 11, Topic B
Parameterized queries Lesson 11, Topic B
Session management Lesson 11, Topic B
Authentication Lesson 11, Topic B
Static analysis tools Lesson 11, Topic C
Dynamic analysis tools Lesson 11, Topic C
Formal methods for verification of critical software Lesson 11, Topic C
Service-oriented architecture Lesson 12, Topic B
Security Assertions Markup Language (SAML) Lesson 12, Topic B
Simple Object Access Protocol (SOAP) Lesson 12, Topic B
Representation State Transfer (REST) Lesson 12, Topic B
Microservices Lesson 12, Topic B
2.3 Explain hardware assurance best practices Lesson 9, Topic C
Hardware root of trust Lesson 9, Topic C

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 7 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Trusted platform module (TPM) Lesson 9, Topic C
Hardware security module (HSM) Lesson 9, Topic C
eFuse Lesson 9, Topic C
Unified Extensible Firmware Interface (UEFI) Lesson 9, Topic C
Trusted foundry Lesson 9, Topic C
Secure processing Lesson 9, Topic C
Trusted execution Lesson 9, Topic C
Secure enclave Lesson 9, Topic C
Processor security extensions Lesson 9, Topic C
Atomic execution Lesson 9, Topic C
Anti-tamper Lesson 9, Topic C
Self-encrypting drive Lesson 9, Topic C
Trusted firmware updates Lesson 9, Topic C
Measured boot and attestation Lesson 9, Topic C
Bus encryption Lesson 9, Topic C
3.0 Security Operations and Monitoring
3.1 Given a scenario, analyze data as part of security monito-Lesson 3, Topic A
ring activities Lesson 3, Topic B
Lesson 3, Topic C
Lesson 3, Topic D
Lesson 4, Topic B
Lesson 6, Topic B
Heuristics Lesson 4, Topic B
Trend analysis Lesson 4, Topic B
Endpoint Lesson 3, Topic C
Malware Lesson 3, Topic C
Reverse engineering Lesson 3, Topic C
Memory Lesson 3, Topic C
System and application behavior Lesson 3, Topic C
Known-good behavior Lesson 3, Topic C
Anomalous behavior Lesson 3, Topic C
Exploit techniques Lesson 3, Topic C
File system Lesson 5, Topic C
User and entity behavior analytics (UEBA) Lesson 3, Topic C
Network Lesson 3, Topic A
Uniform Resource Locator (URL) and domain name systemLesson 3, Topic A
(DNS) analysis
Domain generation algorithm Lesson 3, Topic A
Flow analysis Lesson 3, Topic A
Packet and protocol analysis Lesson 3, Topic A
Malware Lesson 3, Topic A
Log review Lesson 3, Topic B
Event logs Lesson 3, Topic B

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 8 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Syslog Lesson 3, Topic B
Firewall logs Lesson 3, Topic B
Web application firewall (WAF) Lesson 3, Topic B
Proxy Lesson 3, Topic B
Intrusion detection system (IDS)/Intrusion prevention systemLesson 3, Topic B
(IPS)
Impact analysis Lesson 6, Topic B
Organization impact vs localized impact Lesson 6, Topic B
Immediate vs total Lesson 6, Topic B
Security information and event management (SIEM) review Lesson 4, Topic B
Rule writing Lesson 4, Topic B
Known-bad Internet protocol (IP) Lesson 3, Topic A
Dashboard Lesson 4, Topic B
Query writing Lesson 4, Topic B
String search Lesson 4, Topic B
Script Lesson 4, Topic B
Piping Lesson 4, Topic B
E-mail analysis Lesson 3, Topic D
Malicious payload Lesson 3, Topic D
Domain Keys Identified Mail (DKIM) Lesson 3, Topic D
Domain-based Message Authentication, Reporting, andLesson 3, Topic D
Conformance (DMARC)
Sender Policy Framework (SPF) Lesson 3, Topic D
Phishing Lesson 3, Topic D
Forwarding Lesson 3, Topic D
Digital signature Lesson 3, Topic D
E-mail signature block Lesson 3, Topic D
Embedded links Lesson 3, Topic D
Impersonation Lesson 3, Topic D
Header Lesson 3, Topic D
3.2 Given a scenario, implement configuration changes toLesson 3, Topic B
existing controls to improve security Lesson 3, Topic C
Lesson 10, Topic B
Permissions Lesson 10, Topic B
Firewall Lesson 3, Topic B
Whitelisting Lesson 3, Topic C
Blacklisting Lesson 3, Topic C
Intrusion prevention system (IPS) rules Lesson 3, Topic B
Data loss prevention (DLP) Lesson 10, Topic B
Endpoint detection and response (EDR) Lesson 3, Topic C
Network access control (NAC) Lesson 3, Topic B
Sinkholing Lesson 3, Topic B

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 9 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Malware signatures Lesson 3, Topic C
Development/rule writing Lesson 3, Topic C
Sandboxing Lesson 3, Topic C
Port security Lesson 3, Topic B
3.3 Explain the importance of proactive threat hunting Lesson 2, Topic C
Establishing a hypothesis Lesson 2, Topic C
Profiling threat actors and activities Lesson 2, Topic C
Threat hunting tactics Lesson 2, Topic C
Executable process analysis Lesson 2, Topic C
Reducing the attack surface area Lesson 2, Topic C
Bundling critical assets Lesson 2, Topic C
Attack vectors Lesson 2, Topic C
Integrated intelligence Lesson 2, Topic C
Improving detection capabilities Lesson 2, Topic C
3.4 Compare and contrast automation concepts and techno-Lesson 8, Topic B
logies Lesson 12, Topic B
Lesson 12, Topic D
Workflow orchestration Lesson 12, Topic B
Security Orchestration, Automation, and Response (SOAR) Lesson 12, Topic D
Scripting Lesson 12, Topic B
Application programming interface (API) integration Lesson 12, Topic B
Automated malware signature creation Lesson 12, Topic D
Data enrichment Lesson 12, Topic D
Threat feed combination Lesson 12, Topic D
Machine learning Lesson 12, Topic D
Use of automation protocols and standards Lesson 8, Topic B
Security Content Automation Protocol (SCAP) Lesson 8, Topic B
Continuous integration Lesson 12, Topic D
Continuous deployment/delivery Lesson 12, Topic D
4.0 Incident Response
4.1 Explain the importance of the incident response process Lesson 6, Topic A
Communication plan Lesson 6, Topic A
Limiting communication to trusted parties Lesson 6, Topic A
Disclosing based on regulatory/legislative requirements Lesson 6, Topic A
Preventing inadvertent release of information Lesson 6, Topic A
Using a secure method of communication Lesson 6, Topic A
Reporting requirements Lesson 6, Topic A
Response coordination with relevant entities Lesson 6, Topic A
Legal Lesson 6, Topic A
Human resources Lesson 6, Topic A
Public relations Lesson 6, Topic A

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 10 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Internal and external Lesson 6, Topic A
Law enforcement Lesson 6, Topic A
Senior leadership Lesson 6, Topic A
Regulatory bodies Lesson 6, Topic A
Factors contributing to data criticality Lesson 6, Topic A
Personally identifiable information (PII) Lesson 6, Topic A
Personal health information (PHI) Lesson 6, Topic A
Special protected information (SPI) Lesson 6, Topic A
High value asset Lesson 6, Topic A
Financial information Lesson 6, Topic A
Intellectual property Lesson 6, Topic A
Corporate information Lesson 6, Topic A
4.2 Given a scenario, apply the appropriate incident responseLesson 6, Topic A
procedure Lesson 6, Topic B
Lesson 6, Topic C
Preparation Lesson 6, Topic A
Training Lesson 6, Topic A
Testing Lesson 6, Topic A
Documentation of procedures Lesson 6, Topic A
Detection and analysis Lesson 6, Topic B
Characteristics contributing to severity level classification Lesson 6, Topic B
Downtime Lesson 6, Topic B
Recovery time Lesson 6, Topic B
Data integrity Lesson 6, Topic B
Economic Lesson 6, Topic B
System process criticality Lesson 6, Topic B
Reverse engineering Lesson 6, Topic B
Data correlation Lesson 6, Topic B
Containment Lesson 6, Topic B
Segmentation Lesson 6, Topic B
Isolation Lesson 6, Topic B
Eradication and recovery Lesson 6, Topic C
Vulnerability mitigation Lesson 6, Topic C
Sanitization Lesson 6, Topic C
Reconstruction/reimaging Lesson 6, Topic C
Secure disposal Lesson 6, Topic C
Patching Lesson 6, Topic C
Restoration of permissions Lesson 6, Topic C
Reconstitution of resources Lesson 6, Topic C
Restoration of capabilities and services Lesson 6, Topic C
Verification of logging/communication to security monitoringLesson 6, Topic C

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 11 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Post-incident activities Lesson 6, Topic C
Evidence retention Lesson 6, Topic C
Lessons learned report Lesson 6, Topic C
Change control process Lesson 6, Topic C
Incident response plan update Lesson 6, Topic C
Incident summary report Lesson 6, Topic C
Indicator of compromise (IOC) generation Lesson 6, Topic C
Monitoring Lesson 6, Topic C
4.3 Given an incident, analyze potential indicators of compro-Lesson 5, Topic B
mise Lesson 5, Topic C
Lesson 5, Topic D
Network-related Lesson 5, Topic B
Bandwidth consumption Lesson 5, Topic B
Beaconing Lesson 5, Topic B
Irregular peer-to-peer communication Lesson 5, Topic B
Rogue device on the network Lesson 5, Topic B
Scan/sweep Lesson 5, Topic B
Unusual traffic spike Lesson 5, Topic B
Common protocol over non-standard port Lesson 5, Topic B
Host-related Lesson 5, Topic C
Processor consumption Lesson 5, Topic C
Memory consumption Lesson 5, Topic C
Drive capacity consumption Lesson 5, Topic C
Unauthorized software Lesson 5, Topic C
Malicious process Lesson 5, Topic C
Unauthorized change Lesson 5, Topic C
Unauthorized privilege Lesson 5, Topic C
Data exfiltration Lesson 5, Topic C
Abnormal OS process behavior Lesson 5, Topic C
File system change or anomaly Lesson 5, Topic C
Registry change or anomaly Lesson 5, Topic C
Unauthorized scheduled task Lesson 5, Topic C
Application-related Lesson 5, Topic D
Anomalous activity Lesson 5, Topic D
Introduction of new accounts Lesson 5, Topic D
Unexpected output Lesson 5, Topic D
Unexpected outbound communication Lesson 5, Topic D
Service interruption Lesson 5, Topic D
Application log Lesson 5, Topic D

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 12 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

4.4 Given a scenario, utilize basic digital forensics techniquesLesson 3, Topic A
Lesson 5, Topic A
Lesson 5, Topic C
Lesson 5, Topic D
Network Lesson 3, Topic A
Wireshark Lesson 3, Topic A
tcpdump Lesson 3, Topic A
Endpoint Lesson 5, Topic C
Disk Lesson 5, Topic C
Memory Lesson 5, Topic C
Mobile Lesson 5, Topic D
Cloud Lesson 5, Topic D
Virtualization Lesson 5, Topic D
Legal hold Lesson 5, Topic A
Procedures Lesson 5, Topic A
Hashing Lesson 5, Topic A
Changes to binaries Lesson 5, Topic A
Carving Lesson 5, Topic A
Data acquisition Lesson 5, Topic A
5.0 Compliance and Assessment
5.1 Understand the importance of data privacy and protectionLesson 10, Topic A
Lesson 10, Topic B
Privacy vs security Lesson 10, Topic A
Non-technical controls Lesson 10, Topic A
Classification Lesson 10, Topic A
Ownership Lesson 10, Topic A
Retention Lesson 10, Topic A
Data types Lesson 10, Topic A
Retention standards Lesson 10, Topic A
Confidentiality Lesson 10, Topic A
Legal requirements Lesson 10, Topic A
Data sovereignty Lesson 10, Topic A
Data minimization Lesson 10, Topic A
Purpose limitation Lesson 10, Topic A
Non-disclosure agreement (NDA) Lesson 10, Topic A
Technical controls Lesson 10, Topic B
Encryption Lesson 10, Topic B
Data loss prevention (DLP) Lesson 10, Topic B
Data masking Lesson 10, Topic B
Deidentification Lesson 10, Topic B
Tokenization Lesson 10, Topic B
Digital rights management (DRM) Lesson 10, Topic B

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 13 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Watermarking Lesson 10, Topic B
Geographic access requirements Lesson 10, Topic B
Access controls Lesson 10, Topic B
5.2 Given a scenario, apply security concepts in support ofLesson 7, Topic A
organizational risk mitigation Lesson 9, Topic C
Business impact analysis Lesson 7, Topic A
Risk identification process Lesson 7, Topic A
Risk calculation Lesson 7, Topic A
Probability Lesson 7, Topic A
Magnitude Lesson 7, Topic A
Communication of risk factors Lesson 7, Topic A
Risk prioritization Lesson 7, Topic A
Security controls Lesson 7, Topic A
Engineering tradeoffs Lesson 7, Topic A
Systems assessment Lesson 7, Topic A
Documented compensation controls Lesson 7, Topic A
Training and exercises Lesson 7, Topic A
Red team Lesson 7, Topic A
Blue team Lesson 7, Topic A
White team Lesson 7, Topic A
Tabletop exercise Lesson 7, Topic A
Supply chain assessment Lesson 9, Topic C
Vendor due diligence Lesson 9, Topic C
Hardware source authenticity Lesson 9, Topic C
5.3 Explain the importance of frameworks, policies, proce-Lesson 1, Topic A
dures, and controls Lesson 5, Topic A
Lesson 7, Topic B
Lesson 9, Topic A
Lesson 10, Topic A
Frameworks Lesson 7, Topic B
Risk-based Lesson 7, Topic B
Prescriptive Lesson 7, Topic B
Policies and procedures Lesson 5, Topic A
Lesson 7, Topic B
Lesson 9, Topic A
Lesson 10, Topic A
Code of conduct/ethics Lesson 9, Topic A
Acceptable use policy (AUP) Lesson 9, Topic A
Password policy Lesson 9, Topic A
Data ownership Lesson 10, Topic A
Data retention Lesson 10, Topic A
Account management Lesson 9, Topic A
Continuous monitoring Lesson 7, Topic B

Appendix A: Lesson Description | 

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 14 17/04/20 12:52 PM

 Book Title

Domain and Objective Covered in

Work product retention Lesson 5, Topic A
Category Lesson 1, Topic A
Managerial Lesson 1, Topic A
Operational Lesson 1, Topic A
Technical Lesson 1, Topic A
Control types Lesson 1, Topic A
Preventative Lesson 1, Topic A
Detective Lesson 1, Topic A
Corrective Lesson 1, Topic A
Deterrent Lesson 1, Topic A
Compensating Lesson 1, Topic A
Physical Lesson 1, Topic A
Audits and assessments Lesson 7, Topic B
Regulatory Lesson 7, Topic B
Compliance Lesson 7, Topic B

Appendix A: Lesson Description |

LICENSED FOR USE ONLY BY: TAMARA MA JID · 32823961 · AUG 15 2023

Appendix_A_pp_01-15.indd 15 17/04/20 12:52 PM