Example coursework · Independent teaching demonstrations
← All syllabiCOURSE 207 / EIGHT-WEEK HYBRID / CS0-004
CompTIA CySA+ syllabus
An intensive applied course in CompTIA CySA+ objectives, with independently documented technical work.
Course overview and resources · Instructor: justinfreres@gmail.com
Course outcomes and preparation
- Inventory fictional assets, classify telemetry and build a log-source coverage matrix with retention and privacy requirements.
- Analyze configuration and application weaknesses in supplied evidence and design a testable remediation plan.
- Comprehensive station 2: complete the incident timeline, verify recovery and produce distinct technical and executive reports with residual risk and follow-up metrics.
Readiness: Security+ level concepts, network and endpoint logs, vulnerability management and practical security-operations experience.
Plan 12–16 independent hours each week plus the three-hour class (15–19 total). This advanced eight-week format requires prior foundations, sustained reading, practice, weekend lab reservations, remediation and careful evidence preparation. It compresses the schedule, not the work. These are planning estimates, not college credit determinations. Each example uses the same Monday calendar as an alternative offering; arrange a conflict-free schedule before enrolling in multiple blocks.
Class meets Mondays, January 11–March 1, 2027, 5:45–8:45 PM Central. These sample offerings share a calendar; only 107 and 108 are arranged as a concurrent pair.
Prepare → Quiz → Chapter labs → Closeout
Read assigned material, review authorized slides and submit the completed graded handout before class at 5:45 PM. Include reading references, original explanations, lab planning and two questions. Opening quiz: 5:45–6:00. Supervised labs: 6:00–8:10, including a 7:00–7:10 break. Closeout: 8:10–8:45 lecture, corrections, Q&A and announcements.
Outside class, complete at least 45 exam-matching MeasureUP practice questions each week, submit results and remediate three weak concepts. Complete every approved matching NETLAB or licensed remote-lab title with a separately documented section in the graded weekly portfolio. Submit a reflection and professional handoff.
Hybrid deadlines are the following Sunday at midnight, end of day, Central (12:00 AM the next day). Preparation and supervised classwork retain their earlier deadlines. Eight-week study requires substantial dedicated outside time, reliable lab access and attendance.
Unique weekly reading and lab plan
Week 1 · Security operations and evidence baselines
January 11 · Hybrid due January 17
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Security operations: visibility and baselines. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate security operations: visibility and baselines through the two assigned activities, interpreted evidence and a professional handoff.
- Inventory fictional assets, classify telemetry and build a log-source coverage matrix with retention and privacy requirements.
- Normalize supplied endpoint, network and identity records into a timeline; distinguish observed facts from hypotheses.
Closeout: Debrief security operations and evidence baselines; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 2 · Detection engineering and threat analysis
January 18 · Hybrid due January 24
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Security operations: detection and threat analysis. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate security operations: detection and threat analysis through the two assigned activities, interpreted evidence and a professional handoff.
- Write a detection hypothesis and query against synthetic events; measure true/false positives and tune the rule.
- Enrich supplied indicators with instructor-provided intelligence, map behavior to an attack sequence and explain confidence and limitations.
Closeout: Debrief detection engineering and threat analysis; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 3 · Vulnerability assessment and prioritization
January 25 · Hybrid due January 31
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Vulnerability management: assessment and analysis. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate vulnerability management: assessment and analysis through the two assigned activities, interpreted evidence and a professional handoff.
- Review a synthetic vulnerability scan, validate asset context and separate duplicate or unconfirmed findings.
- Prioritize remediation using exploitability, exposure and business impact; propose compensating controls with owners and deadlines.
Closeout: Debrief vulnerability assessment and prioritization; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 4 · Remediation and attack-surface validation
February 1 · Hybrid due February 7
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Vulnerability management: mitigation and validation. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate vulnerability management: mitigation and validation through the two assigned activities, interpreted evidence and a professional handoff.
- Analyze configuration and application weaknesses in supplied evidence and design a testable remediation plan.
- Retest a patched disposable service, verify normal use and document residual risk and remediation metrics.
Closeout: Debrief remediation and attack-surface validation; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 5 · Incident triage and containment
February 8 · Hybrid due February 14
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Incident response and management: triage and containment. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate incident response and management: triage and containment through the two assigned activities, interpreted evidence and a professional handoff.
- Triage a simulated identity/endpoint alert using supplied logs, assign severity and document escalation and evidence handling.
- Compare containment options, apply an authorized isolated-lab control and verify business and security effects with rollback.
Closeout: Debrief incident triage and containment; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 6 · Investigation, recovery and lessons learned
February 15 · Hybrid due February 21
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Incident response and management: investigation and recovery. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate incident response and management: investigation and recovery through the two assigned activities, interpreted evidence and a professional handoff.
- Preserve provided evidence copies, record hashes and custody, and reconstruct a defensible incident timeline.
- Validate recovery against a clean baseline, test recurrence detection and write lessons learned with measurable corrective actions.
Closeout: Debrief investigation, recovery and lessons learned; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 7 · Security reporting and stakeholder communication
February 22 · Hybrid due February 28
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: Reporting and communication. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate reporting and communication through the two assigned activities, interpreted evidence and a professional handoff.
- Prepare a technical analyst report that separates evidence, inference, uncertainty and next investigative steps.
- Create an executive brief and metrics dashboard from the same case, then conduct a simulated stakeholder notification.
Closeout: Debrief security reporting and stakeholder communication; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →Week 8 · CySA+ comprehensive incident-analysis lab
March 1 · Hybrid due March 7
Read before class: Read the current CompTIA CySA+ CS0-004 official objectives and instructor-assigned licensed sections for: All CS0-004 domains. No textbook edition or ISBN has been selected; the instructor must publish exact chapter/page and licensed slide assignments before instruction.
Outcome: Demonstrate all cs0-004 domains through the two assigned activities, interpreted evidence and a professional handoff.
- Comprehensive station 1: correlate synthetic alerts, validate a vulnerability, prioritize risk and justify containment with preserved evidence.
- Comprehensive station 2: complete the incident timeline, verify recovery and produce distinct technical and executive reports with residual risk and follow-up metrics.
Closeout: Debrief cysa+ comprehensive incident-analysis lab; compare evidence and assumptions, correct misconceptions, explain residual risk, answer questions and confirm next reading and Sunday deadline.
Full handout, quiz scope and hybrid assignments →
Assessment and grading
| Category | Weight |
|---|
| Eight opening quizzes | 7.5% |
| Eight weekly practices, minimum 45 questions each | 7.5% |
| Eight graded preparation handouts and eight reflections | 5% |
| Weeks 1–7 classroom labs and eight graded remote-lab portfolios | 20% |
| Week 8 comprehensive practical, assigned stations equally weighted | 30% |
| Actual official certification exam | 30% |
Items share their category equally. A 90–100; B 80–89.99; C 70–79.99; D 60–69.99; F below 60. Missing/ungraded items count zero provisionally. Pre-final coursework is normalized over the combined 70%. At least 70% pre-final coursework and a passing final guarantee at least 70% overall, or the higher weighted result.
Lab rubric: correct result/procedure 40%, reasoning/evidence 30%, permissions/safety/data handling 20%, documentation 10%. Handouts: accuracy 50%, completeness/references 30%, explanations/questions 20%. Practice: verified minimum count 50%, result evidence 25%, remediation 25%. Reflection: technical reasoning 50%, evidence 30%, handoff 20%. Quiz prompts share credit equally.
College policies govern accommodations, integrity, late work, absences, withdrawal and final grade approval. Arrange supervised make-ups and any extensions with the instructor. Use only authorized environments and submit original work. Do not upload exam questions, dumps, live credentials or private customer data. Exact licensed chapter/page assignments, slides and installed remote-lab titles must be approved before delivery; this portal does not provide vendor licenses.
COURSE FINALE / TWO SEPARATE ASSESSMENTS
Comprehensive lab → Official certification exam
1. Comprehensive lab day — 30% of the course
The week 8 meeting is the comprehensive lab day: Monday, March 1, 2027, 5:45–8:45 PM. After the opening readiness quiz, complete one integrated practical with the assigned lab activities as its stations. All stations share the 30% equally. Work independently in the supervised, authorized lab environment; the instructor supplies the fault scenario and permitted tools.
Comprehensive station 1: correlate synthetic alerts, validate a vulnerability, prioritize risk and justify containment with preserved evidence. Comprehensive station 2: complete the incident timeline, verify recovery and produce distinct technical and executive reports with residual risk and follow-up metrics.
Submit a single organized service portfolio across the assigned station submissions: intake and baseline, diagnosis and alternatives, procedure log, before/after evidence, validation tests, rollback or recovery plan, and a customer handoff. Rubric: correct procedure/result 40%; reasoning/evidence 30%; safety, permissions and data handling 20%; documentation 10%. Closeout includes a short explanation of your diagnosis, questions and exam-readiness announcements.
2. Actual certification exam — 30% of the course
After the lab day, take the official CompTIA CySA+ CS0-004 through an authorized testing provider. Schedule a separate appointment after the comprehensive lab and submit result evidence by Sunday, March 7, 2027 at midnight, end of day, America/Chicago. Arrange voucher/payment, identification and testing requirements in advance; this portal does not deliver or book the official exam. MeasureUP is practice and does not replace it. The instructor must announce any approved deadline extension or retake arrangement.
Submit the exam code, date, official scaled score and pass/fail result through the private CertificationExam submission. Provide the official score report through the instructor-approved private method for verification; do not share exam questions or answers. The instructor verifies the result and records the scaled score in administration.
The published passing score for this exam is 750 on a 100–900 scale. For this course only, 100 maps to 0%, the passing score maps to 70%, and 900 maps to 100%, using linear interpolation below and above passing. This is the college course conversion, not CompTIA's percentage score. See the official certification exam information. This course follows the exam version named in its syllabus. Confirm version availability and testing-provider deadlines before buying a voucher or booking.
C-or-better course guarantee
If your pre-exam coursework average is at least 70% and you pass this course's official exam, your final course grade will be at least 70% (C). Pre-exam coursework includes the comprehensive lab and all other non-exam work, normalized over its combined 70% weight. Higher weighted results earn the corresponding higher grade. Missing or unverified exam results remain ungraded and count as zero until verified; they do not trigger the guarantee.