100 CompTIA CySA+ Terms You Need to Know Before Exam Day

Watch: CySA+ 100 Terms

Build your vocabulary before diving into practice questions. This video covers the most important terms — explained clearly, no fluff.

Threat Analysis & Intelligence

1. Threat — An external agent with the intent and capability to exploit vulnerabilities and cause damage. Understanding threat actors and their motivations is the job of a CySA.

2. Threat Actor — The person or group conducting an attack. Threat actors can be nation-states, criminal groups, hacktivists, or insiders.

3. Threat Intelligence — Information about threats, threat actors, and attack methodologies. CySA professionals leverage threat intel to defend effectively.

4. Threat Hunting — Proactively searching for indicators of compromise and advanced threats that automated detection misses. The most valuable skill a CySA can develop.

5. Advanced Persistent Threat (APT) — A sophisticated threat actor, usually nation-state, with advanced capabilities and long-term persistence objectives. APTs are dangerous because they’re patient and resourceful.

6. Kill Chain — The stages of an attack: reconnaissance, weaponization, delivery, exploitation, installation, command and control, and objectives. Understanding the kill chain enables effective defense.

7. MITRE ATT&CK Framework — A comprehensive database of threat actor tactics and techniques used across attack lifecycle. The gold standard reference for CySA professionals.

8. TTP (Tactics, Techniques, Procedures) — How threat actors operate. Tactics are goals; techniques are methods; procedures are specific implementations. TTP analysis enables threat hunting.

9. IOC (Indicator of Compromise) — Observable artifacts indicating a system has been compromised. IP addresses, file hashes, domain names, and registry keys are all IOCs.

10. IoA (Indicator of Attack) — Observable signs that an attack is occurring, even if compromise hasn’t happened yet. More proactive than IOCs.

11. C2 (Command and Control) — Infrastructure used by attackers to maintain persistence and direct compromised systems. Taking down C2 servers disrupts ongoing attacks.

12. Malware Analysis — Examining malware code, behavior, and capabilities to understand what it does. Static analysis examines code; dynamic analysis observes behavior.

13. Sandbox — An isolated environment for safely analyzing malware without risking production systems. Detonating files in sandboxes is standard practice.

14. Rootkit — Malware that gains administrator-level access and hides itself from detection. One of the most dangerous types of malware.

15. Backdoor — A hidden method for maintaining unauthorized access to a system after initial compromise. Remote access trojans often install backdoors.

16. Botnet — A network of compromised systems controlled remotely by attackers. Botnets conduct DDoS attacks, send spam, and spread malware.

17. Command Injection — Exploiting application input to execute arbitrary OS commands. A critical web application vulnerability CySA must understand.

18. Cross-Site Scripting (XSS) — Injecting malicious scripts into web pages viewed by other users. Stored XSS is more dangerous than reflected XSS.

19. SQL Injection — Inserting SQL code into application inputs to manipulate databases. Still one of the most common vulnerabilities in production applications.

20. Privilege Escalation — Gaining higher-level permissions than initially granted. A critical step in the attack chain after gaining initial access.

Detection & Analysis

21. SIEM (Security Information and Event Management) — The centralized system collecting, correlating, and analyzing logs from across the environment. The core tool for threat detection.

22. Log Aggregation — Collecting logs from all systems and devices into one central location for analysis. Without log aggregation, you’re blind to threats.

23. Event Log — Records of system, application, and security events generated by Windows or Linux systems. Critical data source for threat hunting and incident investigation.

24. Syslog — The Linux standard for system logging. Many network devices also send syslog messages.

25. Log Retention — How long logs are kept for investigation. CySA professionals recommend 90 days minimum, one year for sensitive environments.

25. Baseline — The normal state of a system, network, or user behavior. Detecting deviations from baseline is how you spot threats.

27. Anomaly — Deviation from established baseline behavior. A user accessing files at 3 AM after accessing them only during business hours is anomalous.

28. False Positive — A detection that triggers an alert but isn’t actually malicious. Too many false positives exhaust analysts and create alert fatigue.

29. True Positive — A detection that correctly identifies malicious activity. The alerts you actually care about.

30. Correlation — Linking events together to tell a story about an attack. One log entry might seem harmless; correlated with others, it reveals compromise.

31. Wireshark — The industry standard packet analyzer for deep network traffic inspection. Essential tool for network-level threat detection.

32. Pcap — A packet capture file containing network traffic for analysis. Pcaps are goldmines for post-incident forensics.

33. Network Segmentation — Dividing networks to contain threats and limit lateral movement. A zero-trust principle implemented through VLANs and firewalls.

34. Intrusion Detection System (IDS) — A network appliance monitoring traffic for signatures matching known attacks. IDS signatures are pattern-based detection.

35. Intrusion Prevention System (IPS) — An IDS with the ability to actively block malicious traffic. IPS requires careful tuning to avoid blocking legitimate traffic.

36. Web Application Firewall (WAF) — Application-layer protection against web-based attacks. Defends against OWASP Top 10 vulnerabilities.

37. Data Loss Prevention (DLP) — Controls detecting and blocking unauthorized data exfiltration. DLP can monitor USB drives, email, and cloud uploads.

38. User Behavior Analytics (UBA) — Monitoring user activities to detect anomalous behavior indicating compromise or insider threats. A growing detection capability.

39. Behavioral Analysis — Analyzing how users, applications, and systems normally behave to detect deviations. Proactive detection technique.

40. Heuristic Detection — Identifying malware based on suspicious behaviors rather than signatures. Detects new, unknown malware.

Vulnerability Management

41. Vulnerability — A weakness that can be exploited to cause harm. Identifying and remediating vulnerabilities is core to CySA work.

42. Vulnerability Assessment — Systematically scanning systems to identify known vulnerabilities. Automated but requires expert analysis to prioritize.

43. Vulnerability Scan — Running automated tools to discover vulnerabilities. Different tools find different types of vulnerabilities.

44. CVSS (Common Vulnerability Scoring System) — A standardized framework for rating vulnerability severity. Scores range from 0 (none) to 10 (critical).

45. CVE (Common Vulnerabilities and Exposures) — The public database of known vulnerabilities. Each vulnerability gets a unique CVE identifier (e.g., CVE-2024-1234).

46. Zero-Day — A vulnerability unknown to vendors and security researchers. Zero-days are highly valuable to attackers.

47. Exploit — Code or technique that leverages a vulnerability to compromise a system. Exploits are weaponized vulnerabilities.

48. Patch Management — The systematic process of applying security updates. Patching is the most cost-effective security control available.

49. Patch Tuesday — Microsoft’s monthly security update release on the second Tuesday of each month. Many organizations have patching processes keyed to this schedule.

50. Vulnerability Prioritization — Ranking vulnerabilities by exploitability, impact, and business context. Not all critical vulnerabilities require immediate patching.

51. Configuration Review — Auditing system and application configurations for security issues. Misconfigurations are a leading cause of breaches.

52. CIS Benchmark — Security best practices for hardening systems and applications. The gold standard for secure configuration.

53. Penetration Testing — Authorized simulated attacks to discover vulnerabilities. More thorough than vulnerability scanning but also more time-consuming.

54. Red Team / Blue Team — Red team simulates attackers; blue team defends. Red team exercises test security controls.

55. Fuzzing — Providing random or malformed input to applications to discover vulnerabilities. Effective at finding edge-case bugs.

56. Static Application Security Testing (SAST) — Analyzing source code for vulnerabilities without running it. Catches bugs early in development.

57. Dynamic Application Security Testing (DAST) — Testing running applications by interacting with them. Closer to real-world attack scenarios.

58. Remediation — The action taken to fix a vulnerability, whether through patching, configuration change, or disabling the feature.

59. Root Cause Analysis — Determining why a vulnerability exists to prevent similar issues. Goes beyond fixing the symptom.

60. Compensating Controls — Alternative controls that reduce risk when the preferred control isn’t available. “We can’t patch yet, but we’ve network segmented and we’re monitoring.”

Incident Response & Recovery

61. Incident — A security event that has breached controls or caused harm. Not all security events are incidents.

62. Incident Response Plan — A documented process for detecting, analyzing, containing, and recovering from security incidents. Every organization should have one.

63. Incident Response Team — The people responsible for executing incident response. Usually includes security, IT, legal, and management.

64. Detection — The first phase of incident response—identifying that an incident is occurring. Detection speed directly impacts containment.

65. Analysis — Understanding the scope, nature, and impact of an incident. Answer: What happened? How? Who did it? What was affected?

66. Containment — Stopping the attack’s spread. Short-term containment might temporarily disable systems; long-term containment applies permanent fixes.

67. Eradication — Removing the attacker’s presence from all systems. Includes patching, credential resets, and malware removal.

68. Recovery — Restoring systems to normal operations. May require data recovery from backups if data was deleted.

69. Post-Incident Activities — Lessons learned and improvement activities after an incident. Prevents recurrence of the same incident.

70. Data Exfiltration — Unauthorized copying or transmission of data outside the organization. Often the true objective of targeted attacks.

71. Forensic Acquisition — Collecting evidence from systems in a way that preserves integrity. Chain of custody is critical.

72. Chain of Custody — Documentation of evidence handling from collection through presentation. Required for legal cases.

73. Forensic Analysis — Examining evidence to determine what happened and who did it. Can take weeks or months for complex incidents.

74. Memory Dump — A capture of system RAM, which contains active processes, open files, and network connections. Critical forensic artifact.

75. Disk Image — A bit-for-bit copy of a hard drive. Enables analysis without potentially damaging the original.

76. Volatile Data — Information that’s lost when a system is powered off (RAM, network connections, running processes). Collect volatile data before powering down.

77. Non-Volatile Data — Data that persists after power loss (files, logs on disk). Less time-sensitive than volatile data.

78. MTTR (Mean Time to Respond) — The average time from incident detection to first response. Faster response reduces damage.

79. MTBF (Mean Time Between Failures) — The average time between system incidents. Higher MTBF indicates a more mature security program.

80. RTO (Recovery Time Objective) — The maximum acceptable downtime. Influences disaster recovery strategy choices.

Compliance, Reporting & Tools

81. Compliance — Meeting regulatory requirements and security standards. HIPAA, PCI-DSS, GDPR, SOX, and NIST are common requirements.

82. Audit — An independent assessment of security controls and compliance posture. Internal audits or external third-party audits.

83. Control Effectiveness — How well a control actually prevents or detects threats. Testing controls is essential to verify they work.

84. Security Metrics — Quantitative measures of security effectiveness. Examples: patching rate, vulnerability remediation time, incident count.

85. Key Performance Indicators (KPIs) — Metrics that indicate whether security objectives are being met. Used in security dashboards and reports.

86. Security Awareness Training — Educating users about threats and safe practices. The most cost-effective security investment.

87. Phishing Simulation — Testing employees’ vulnerability to phishing by sending fake phishing emails. Identifies training gaps.

88. Risk Register — A documented list of risks facing the organization with assessment and mitigation plans. Living document updated regularly.

89. Business Continuity Planning — Processes to maintain essential operations during disruptions. CySA work supports BC plans by improving resilience.

90. Disaster Recovery Plan — Specific procedures for recovering from major incidents. Includes RTO, RPO, and recovery procedures.

91. Security Information and Event Management (SIEM) — The central tool for collecting and analyzing security events. Examples: Splunk, IBM QRadar, ArcSight.

92. Playbook — A documented, step-by-step procedure for responding to specific incident types. Reduces response time and ensures consistency.

93. Automation — Using scripts and tools to perform repetitive security tasks. Automation scales incident response and reduces human error.

94. Alert Tuning — Adjusting detection rules to reduce false positives while maintaining detection accuracy. Requires ongoing refinement.

95. Threat Modeling — Systematically identifying potential threats to applications and systems. Guides security investments.

96. Security Testing — Authorized testing of security controls to verify they work. Includes penetration testing and vulnerability scanning.

97. Continuous Monitoring — Ongoing assessment of security posture rather than periodic testing. Enables detection of changes between assessments.

98. Incident Reporting — Formal documentation and communication about incidents to stakeholders. Includes timeline, impact, and lessons learned.

99. Stakeholder Communication — Keeping management, legal, customers, and regulators informed about incidents. Transparency is critical.

100. CompTIA CySA+ Certification — The advanced security certification validating your ability to analyze threats, manage vulnerabilities, and respond to incidents like a true professional. Your career accelerator in cybersecurity.

Ready to Pass Your CySA+ Exam?

These 100 terms will get you speaking the language of threat analysis and incident response. But mastery comes from applying these concepts in real scenarios. At Cover6 Academy, we’ve built CySA+ courses with practice scenarios that reflect actual job responsibilities—not just test questions. We don’t gatekeep; we teach.

Start mastering CySA+:

• Full practice exams and labs: cover6solutions.com/courses
• Join The6 community: cover6solutions.com/the6
• Subscribe on YouTube: youtube.com/c/cover6solutions
• Join our Discord: discord.gg/x7MXS3yMqb

Your success is our reward. — The Cover6 Solutions Team