CompTIA CySA+
Security operations, vulnerability management and incident response. Work through the topics from the start of the list to the end. Readiness is calculated from your recorded study, labs, practice, quizzes and troubleshooting.
Overall readiness
0%
Status
Not Started
Topics
4
Recommended study time
35h 5m
Exam readiness: CompTIA CySA+
Not started — Nothing recorded for this certification yet. Study one topic and the score starts moving.
80 points to the 80% exam-ready bar
0 of 4 topics finished · 35h 5m of study left
About 12 weeks away — roughly December 2026, at your planned 180 minutes a week.
What is holding the score back
Study path
Start with the groundwork, then core skills, then the advanced material.
The main body of the certification: the skills the exam tests most.
Harder material that assumes the earlier work is solid.
Reading and watching
Official material from the vendors themselves. Links open in a new tab.
WATCH
- Professor Messer video channel — general CompTIA training (no dedicated CompTIA CySA+ course)Professor Messer · video · free
READ
Nothing linked yet.
Worked examples
The calculations and procedures this certification expects you to perform, shown step by step with practice items.
Convert binary to decimal
Convert the 8-bit binary number 11000000 to decimal.
- 1. Write the place valuesAn 8-bit number has fixed place values, left to right: 128, 64, 32, 16, 8, 4, 2, 1.
- 2. Line the bits up under the place values128→1, 64→1, 32→0, 16→0, 8→0, 4→0, 2→0, 1→0.
- 3. Keep only the place values above a 1The 128 column and the 64 column hold a 1. Every other column holds 0 and contributes nothing.
- 4. Add them128 + 64 = 192.
Answer: 11000000 = 192. This is why a /24 subnet mask octet of 11000000 reads as 192 in dotted decimal.
Now you try
Convert 10101010 to decimal.
Convert 11111111 to decimal.
Convert 00011100 to decimal.
Convert decimal to binary
Convert the decimal number 172 to 8-bit binary.
- 1. Start at the largest place valueAsk: does 128 fit into 172? Yes. Write a 1 and subtract: 172 − 128 = 44.
- 2. Next column, 6464 does not fit into 44. Write 0. Remainder stays 44.
- 3. Next column, 3232 fits into 44. Write 1. 44 − 32 = 12.
- 4. Continue down16 into 12? No → 0. 8 into 12? Yes → 1, remainder 4. 4 into 4? Yes → 1, remainder 0. 2 → 0. 1 → 0.
- 5. Read the bits in order1, 0, 1, 0, 1, 1, 0, 0.
Answer: 172 = 10101100. Check it by adding the on-bits back: 128 + 32 + 8 + 4 = 172.
Now you try
Convert 200 to binary.
Convert 19 to binary.
Convert 255 to binary.
Convert binary to hexadecimal
Convert 11011110 to hexadecimal (the form used by MAC and IPv6 addresses).
- 1. Split into 4-bit groups11011110 becomes 1101 and 1110.
- 2. Convert each group with place values 8, 4, 2, 11101 = 8 + 4 + 1 = 13. 1110 = 8 + 4 + 2 = 14.
- 3. Replace values over 9 with letters10=A, 11=B, 12=C, 13=D, 14=E, 15=F. So 13 = D and 14 = E.
- 4. Join the digitsD followed by E.
Answer: 11011110 = DE in hex, which is 222 in decimal. Each pair of hex digits is exactly one byte, which is why a MAC address is six hex pairs.
Now you try
Convert 10101111 to hex.
Convert hex 3C to binary.
Convert hex FF to decimal.
Work out a network address and host range
A host is configured as 192.168.10.77 with the mask 255.255.255.192 (/26). What is its network address, broadcast address and usable host range?
- 1. Find the interesting octetThe first three octets of the mask are 255, so only the fourth octet matters. 192 in binary is 11000000, so 2 host-network bits are borrowed.
- 2. Find the block size256 − 192 = 64. Subnets step in blocks of 64: 0, 64, 128, 192.
- 3. Place the host77 falls between 64 and 127, so the host sits in the 192.168.10.64 subnet.
- 4. Name the boundariesNetwork address = 192.168.10.64. Broadcast = one below the next block = 192.168.10.127.
- 5. Usable hostsEverything between the two boundaries: .65 through .126.
Answer: Network 192.168.10.64, broadcast 192.168.10.127, usable range 192.168.10.65–192.168.10.126 (62 usable addresses).
Now you try
Same question for 10.0.0.200 /26.
What mask is /28 in dotted decimal, and what is its block size?
How many usable hosts in a /29?
Count usable hosts from a CIDR prefix
How many usable host addresses does a /22 network provide?
- 1. Count host bitsAn IPv4 address is 32 bits. 32 − 22 = 10 host bits.
- 2. Raise 2 to that power2^10 = 1024 total addresses in the block.
- 3. Remove the two reserved addressesThe lowest address is the network address and the highest is the broadcast address: 1024 − 2.
Answer: 1022 usable host addresses. The general formula is 2^(32 − prefix) − 2.
Now you try
Usable hosts in a /30?
You need 500 hosts on one subnet. What is the smallest prefix?
Total addresses in a /16?
Practice exam
Randomly generated from 48 questions. Written answers are graded on the idea, not on exact wording.
CompTIA CySA+ practice exam
20 randomly generated questions drawn from 48 in the CompTIA CySA+ bank.
20 questions. Question order and eligible choice order change with every attempt, and answers are saved as you work.
Practice
A fresh selection of practical work each time you generate.
- Incident record: Blocking thousands of stale indicators produces noise…incident
- Troubleshoot: Noisy rulestroubleshoot
- Compare IOC and TTPcompare
- Recall the key terms of Log Analysis and Detection Engineeringrecall
CompTIA CySA+ (CS0-003)
Security operations, vulnerability management and incident response.
Status: Not Started — no evidence recorded yet
Knowledge readiness
0%Practical readiness
0%Troubleshooting readiness
0%Retention
0%Quiz performance
0%Lab completion
0%Practice completion
0%Overall readiness
0%Domain readiness
Weak domains are listed first.
Security Operations
0%2 objectives · no evidence yet · weak
Vulnerability Management
0%1 objective · no evidence yet · weak
Incident Response
0%1 objective · no evidence yet · weak
Reporting
0%1 objective · no evidence yet · weak
Exam objectives
Objectives are editable data. Edit, add or remove them and readiness recalculates.
- 1.1 — Analyse network and endpoint telemetrySecurity Operations · 1 mapped topic(s)
- 1.2 — Use log analysis to confirm suspicious activitySecurity Operations · 1 mapped topic(s)
- 2.1 — Prioritise findings by real riskVulnerability Management · no mapped topic yet
- 3.1 — Follow containment and eradication stepsIncident Response · 1 mapped topic(s)
- 4.1 — Communicate findings to technical and business readersReporting · 1 mapped topic(s)
Exam result
IT PATH never marks an exam as passed. You confirm the result yourself.
No exam results recorded.