Prerequisite: Security+ fluency (weeks 0)
If Security+ vocabulary (ports, crypto, controls, attack types) is not instant, CySA+ questions will drown you in reading load. The 165-minute format means long, log-heavy, multi-step items. Every second spent decoding basics is stolen from analysis. Run the readiness check first: below 7/10 means patch Security+ gaps before starting this plan, not during it.
Weeks 1-2: Log reading as a daily habit
SIEM output, firewall denies, authentication sequences, DNS weirdness. Read a little every day. Speed at parsing logs is THE CySA+ skill, and it only comes from volume. Practice correlating: one log is a hint, three agreeing sources are a finding. Time yourself weekly on a sample investigation; if parsing still eats half your session in week 3, double the daily log volume before adding new topics.
Weeks 3-4: Triage and frameworks
Vulnerability reports ranked by exploitability-plus-context (not raw CVSS), threat intel mapped to ATT&CK tactics, IOC extraction from samples. Learn CVSS as prioritization logic and ATT&CK as vocabulary. Technique-to-tactic mapping should feel like reading, not recalling.
Week 5: Response and communication
Playbook ordering (investigate before containing, contain before eradicating), script and regex READING (you interpret code, rarely write it), and incident notes. The exam scores communication more than candidates expect. Practice writing the one-paragraph finding.
Week 6: Long-form simulation
Full sittings at full length. CySA+ punishes rushing (long stems hide the actual question) and dawdling (165 minutes still ends). Practice finding the real question in each stem first, evidence second, answer last.
A worked 5-minute triage (the exam's favorite shape)
Alert: impossible-travel login plus a new inbox rule forwarding everything externally. Read order: authentication logs (confirm the logins and source), then mailbox audit (confirm the rule and its creation time), then firewall/proxy (confirm data movement). Conclusion: compromised credentials with persistence via mail forwarding. Disable, reset, remove rule, hunt laterally. Notice the verbs: confirm, correlate, contain. Every analysis question grades that sequence.
The one-paragraph finding (write it weekly)
'On [date], [source] showed [evidence], indicating [conclusion] with [confidence]. Recommended: [action].' Example: 'On review, firewall logs showed 400 denied SMB connections from host H-114 to the finance server, indicating lateral-movement attempts with high confidence. Recommended: isolate H-114 and hunt credentials.' Write one of these per practice investigation. The exam's communication questions grade exactly this shape: evidence, conclusion, recommendation, in that order.
The analyst mindset in one line
Assume nothing, correlate everything, write it down.
The six-week calendar
- Week 1: reading speed. One log source a day: authentication, firewall, proxy, DNS, endpoint. No new concepts, just parse and summarize.
- Week 2: investigation shape. Correlate two sources, then three. Write a one-paragraph finding for every practice alert.
- Week 3: vulnerability work. CVSS as prioritization, scanning output, false positives, compensating controls.
- Week 4: threat intelligence and frameworks. ATT&CK tactics, IOC handling, threat feeds, and the difference between a tactic and a technique.
- Week 5: response and communication. Playbook order, containment decisions, evidence handling, and the report the exam expects.
- Week 6: simulations. Full-length sittings, review, and a final pass over the weak domains.
The calendar assumes Security+ fluency. If ports or attack families still need translation, spend two extra weeks before week 1 instead of studying both at once.
Practise with labs and PBQs
Reading speed is built on real queues, not on definitions. The CS0-004 pack holds 35 performance-based questions and 41 labs, run against a SIEM queue and a console, and the grade reads both the state you leave and the note you write (counts from the live catalogue).
Put them inside the plan rather than around it. Week 1: one queue review a day, no configuration, just sort and summarise. Weeks 2 and 3: triage and vulnerability-prioritisation tasks, where the answer is an order rather than a fact. Weeks 4 and 5: containment and scoping, where over-containment costs production and under-containment costs the investigation. Week 6: two mixed sittings with the clock running.
The lab you repeat is worth three you skim. After a failed task, rewrite the one-paragraph finding using only the evidence you actually had, then redo the task from scratch the next day. The CySA+ lab catalogue lists each task against its objective, and what a CySA+ task really feels like explains why that beats another thousand definitions.
Log sources the exam expects
Learn what each source can prove. Authentication logs prove who tried, from where, and whether it worked. Firewall logs prove allowed and denied flows, but not payload. Proxy logs prove destinations and URLs, not necessarily content. DNS logs prove lookups and can reveal beaconing through regular intervals. Endpoint logs prove process, parent process, and command line. Email logs prove delivery, links, and rules.
The exam rarely asks which log to open. It gives you two logs and asks what they prove together. Practice saying "this proves, this suggests, this cannot tell us" for each pair.
Tools by name
You should recognize the job of each tool family: SIEM for correlation and retention, SOAR for repeatable response, EDR for endpoint telemetry and containment, vulnerability scanner for inventory and findings, packet capture for proof of a flow, and ticketing for the audit trail. You do not need product-specific clicks. You need to know which tool answers which question and what each one cannot see.
The report habit
Write one finding a day in the four-part shape: evidence, conclusion, confidence, recommendation. Keep them in one file. By exam week you will have forty examples, and the communication questions will read like a familiar format instead of a writing test. The exam scores clarity, not length. A short finding with a clear recommendation beats a page of narrative.
If you fail
CySA+ failures usually come from pace, not knowledge. If the score report shows a low domain that you studied hard, the problem is reading speed under time, not the material. Practice with a timer and force yourself to identify the ask in the first sentence of each stem. If a domain is genuinely weak, rebuild it with logs and write findings until the pattern is obvious. Book the retake two to three weeks out and keep one full simulation a week until then.
Pace beats depth under time
The 165-minute format rewards a steady reader. Practice finishing a set with ten minutes left, then use those minutes to reread flagged stems rather than to start new analysis. If you routinely run out of time, cut your per-question target by ten seconds and accept that one hard question will be a guess. A guess at the end costs one point. Running out of time costs every remaining question.
After CySA+
CySA+ opens analyst roles and pairs well with a SIEM or cloud security certificate. PenTest+ is the offensive next step, and SecurityX is the senior architect step. If you want cloud, the AWS or Azure security paths reuse the same investigation habits with different telemetry. Whichever you pick, keep the report habit. It is the part of the job that interviews test.