🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Certification Exam Preparation: Security+, CySA+, and ISC2 CC › Lesson 2
TEC-CYBE44-10 · Lesson 2 · 42 clock hours · theory

Domain-by-Domain Content Review: Security+, CySA+, and ISC2 CC

Objective. Learners review all exam domains across the three credentials—covering topics such as threats and vulnerabilities, security architecture, identity management, incident response, security operations, compliance, and risk management—and correctly answer targeted practice questions at the close of each domain block.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Domain-by-Domain Review Works

Preparing for three credentials at once—CompTIA Security+, CompTIA CySA+, and ISC2 CC—can feel overwhelming. The most reliable method is to break each exam into its published domains, master one block at a time, and then connect the ideas across credentials. All three exams share conceptual overlap (threats, access control, incident response), but each tests that knowledge at a different depth and from a different angle. Security+ tests broad foundational knowledge. CySA+ tests analytical and detective skills a SOC analyst applies daily. ISC2 CC introduces the governance and ethical mindset expected of a security professional at any level.

Security+ Domain Overview

CompTIA publishes the current exam objectives on its website at no charge. Security+ is organized into major domain areas: General Security Concepts, Threats, Vulnerabilities and Mitigations, Security Architecture, Security Operations, and Security Program Management and Oversight. For each domain, you must be able to recognize terminology, select the best control for a given scenario, and interpret output from common tools.

Threats, Vulnerabilities, and Mitigations is typically the heaviest domain by question weight. Expect questions on malware types (ransomware, spyware, rootkits), social engineering tactics (phishing, vishing, pretexting), and vulnerability scanning versus penetration testing. Know the difference between a threat actor and a threat vector, and understand how indicators of compromise (IoCs) are used to confirm an attack.

Security Architecture covers network segmentation, zero-trust principles, cloud deployment models (IaaS, PaaS, SaaS), virtualization, and secure network design using DMZs, VLANs, and firewalls. Understand why defense-in-depth places multiple controls in layers so a single failure does not expose the entire environment.

Identity and Access Management (covered under General Security Concepts and Security Operations) addresses authentication factors, multi-factor authentication (MFA), privileged access management (PAM), and directory services. The principle of least privilege—granting only the access a user needs to do their job—is a recurring test theme.

Security Program Management and Oversight covers risk management vocabulary: assets, threats, vulnerabilities, likelihood, impact, and risk appetite. It also covers compliance frameworks (NIST CSF, ISO/IEC 27001 concepts), data privacy regulations in general terms, and audit concepts.

CySA+ Domain Overview

CySA+ assumes you already hold Security+-level knowledge and pushes you into the analyst role. Domains address Security Operations, Vulnerability Management, Incident Response and Management, and Reporting and Communication.

Security Operations focuses on continuous monitoring using a SIEM (Security Information and Event Management) platform, interpreting log data, identifying anomalies, and triaging alerts. You must understand how a SOC is structured, what a playbook is, and how threat intelligence feeds integrate into detection.

Vulnerability Management moves beyond identifying vulnerabilities to prioritizing and remediating them. Key concepts include CVSS (Common Vulnerability Scoring System) scoring, asset criticality, patch management workflows, and scanning credentialed versus non-credentialed scans.

Incident Response and Management follows the standard NIST SP 800-61 lifecycle: Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. Know what artifacts are collected at each phase and why chain of custody matters for digital evidence.

Reporting and Communication tests your ability to convey technical findings to both technical peers and non-technical stakeholders, create executive summaries, and track metrics like mean time to detect (MTTD) and mean time to respond (MTTR).

ISC2 CC Domain Overview

The ISC2 Certified in Cybersecurity (CC) credential is entry-level and governance-focused. Domains cover Security Principles, Business Continuity (BC), Disaster Recovery (DR) and Incident Response Concepts, Access Controls Concepts, Network Security, and Security Operations.

Security Principles introduces the CIA Triad (Confidentiality, Integrity, Availability) and adds Authenticity and Non-repudiation. The (ISC)² Code of Ethics and concepts of due care versus due diligence appear here.

Business Continuity and Disaster Recovery distinguishes between the two: BC keeps critical functions running during a disruption; DR restores systems after one. Know RTO (Recovery Time Objective) and RPO (Recovery Point Objective) and how they drive backup strategies.

Access Controls revisits least privilege, separation of duties, and physical controls (locks, badges, mantraps). The CC exam connects physical security firmly to cybersecurity, an important reminder that protecting hardware is as critical as protecting software.

How to Use Domain Quizzes Effectively

After each domain review session, you will complete a timed 20-question quiz. Scoring 75% or above is the minimum threshold to move forward. If you score below 75%, you receive a targeted reading assignment and must complete a fresh 20-question set. This is not a penalty—it is a feedback loop. Every question you answer incorrectly is a gap that the real exam will expose. Log each missed concept in your error log with one sentence explaining the correct reasoning. Over time, your error log becomes a personalized study guide built from your own weak spots.

Cornell Note-Taking for Exam Prep

During instructor-led sessions, use the Cornell method: divide your page into a narrow left cue column, a wide right notes column, and a bottom summary box. Write main ideas and definitions in the notes column during the session. After class, write questions or key terms in the cue column that match each note. At the bottom, write a two- to three-sentence summary in your own words. Annotate your notes with real-world examples from earlier coursework—connecting a concept like network segmentation to a lab you completed makes it stick far better than memorizing a definition alone.

A Note on Accuracy and Honesty

Always verify exam objective details against the official CompTIA and ISC2 candidate resources. Exam domains and weightings change when a new exam version releases. Rely on official documents, not informal sources, for the authoritative list of objectives. This habit of verifying primary sources is also a core professional skill in cybersecurity itself.

Key terms10

CIA TriadThe three foundational security properties: Confidentiality (limiting data access to authorized parties), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring systems and data are accessible when needed).
Least PrivilegeThe principle that a user, process, or system should be granted only the minimum access rights needed to perform its assigned function, reducing the potential damage from error or attack.
Indicator of Compromise (IoC)Forensic evidence—such as unusual outbound traffic, unexpected account logins, or known malicious IP addresses—that suggests a system may have been breached.
SIEM (Security Information and Event Management)A platform that collects, aggregates, and correlates log and event data from across an environment in near real time, enabling analysts to detect and investigate threats.
CVSS (Common Vulnerability Scoring System)An open framework that produces a numeric score from 0 to 10 representing the severity of a software vulnerability, used to prioritize remediation efforts.
Recovery Time Objective (RTO)The maximum acceptable length of time that a system or process can be offline after a disruption before the impact becomes unacceptable to the organization.
Recovery Point Objective (RPO)The maximum acceptable amount of data loss measured in time; it defines how frequently backups must be taken so recovery leaves no more than a defined gap.
Defense-in-DepthA layered security strategy that places multiple independent controls at different points in an environment so that failure of any single control does not expose the entire system.
Zero TrustA security model that assumes no user, device, or network segment is inherently trustworthy; every access request must be verified, authorized, and continuously validated regardless of location.
Chain of CustodyThe documented, unbroken record of who collected, handled, transferred, and stored digital or physical evidence, ensuring its integrity and admissibility in legal or disciplinary proceedings.
In class: Work through instructor-led domain review sessions (approximately 14 hours per credential) using official CompTIA study guides, the ISC2 CC candidate information document, and supplementary video resources such as Professor Messer's free Security+ course notes; take structured notes using the Cornell method and annotate with real-world examples from prior coursework. · After each domain block, complete a 20-question timed domain quiz in the question bank, review every incorrect answer using the platform's explanation feature, and record the concept in a personal error log with a one-sentence explanation of why the correct answer is correct. · Participate in instructor-facilitated Socratic review sessions where the instructor presents scenario-based stems (e.g., 'A SOC analyst sees repeated failed login attempts from a single IP — which control is BEST?') and learners must select, justify, and debate answers before the correct response is revealed.
Materials: CompTIA Security+ Study Guide (current exam version, Sybex or Mike Chapple/David Seidl edition); CompTIA CySA+ Study Guide (current exam version); ISC2 CC official candidate resources; Professor Messer free study notes and practice exams (professormesser.com); Jason Dion Udemy practice exams or equivalent; whiteboard; printed domain-objective checklists from CompTIA and ISC2 websites.
Check: Each domain quiz must score 75% or higher; learners who score below 75% on any domain quiz receive a targeted remediation reading assignment and must retest on a fresh 20-question set before the course advances; instructor spot-checks error logs for completeness.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ – Threats, Vulnerabilities, and Mitigations
1. A user receives an email that appears to come from the company's IT helpdesk asking them to reset their password on an external website. Which type of attack does this BEST describe?
ISC2 CC – Access Controls Concepts
2. An organization wants to ensure that no single employee can both approve and process a financial transaction in the IT system. Which security principle does this BEST implement?
CompTIA CySA+ – Security Operations
3. A SOC analyst reviewing SIEM alerts notices thousands of failed SSH login attempts from a single external IP address over a 10-minute window. Which type of attack is MOST likely occurring?
CompTIA CySA+ – Vulnerability Management
4. A vulnerability scan returns a CVSS base score of 9.1 for a flaw in a public-facing web server and a score of 4.3 for a flaw in an internal development workstation. Assuming equal asset criticality, which vulnerability should the team remediate FIRST?
CompTIA CySA+ – Incident Response and Management
5. During incident response, a security team isolates a compromised server from the network. According to the NIST SP 800-61 incident response lifecycle, which phase does this action belong to?
ISC2 CC – Business Continuity, Disaster Recovery, and Incident Response
6. An organization's RTO for its order management system is four hours. A disaster occurs at 10:00 AM. By what time must the system be restored to meet the RTO?
CompTIA Security+ – Security Architecture
7. A network architect places web servers in a zone that is reachable from the internet but separated from the internal corporate network by a firewall. What is this zone called?
CompTIA CySA+ – Reporting and Communication
8. A security manager is presenting vulnerability remediation progress to the executive team. The report shows the average number of days between when a vulnerability is confirmed and when a patch is deployed. Which metric does this BEST represent?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →