Malicious Activity Analysis, Tools, Automation and AI
This topic covers network, host, application, and cloud indicators, SIEM, EDR, packet capture, scripting, SOAR, tuning, playbooks, process improvement, and governed AI use.
How to study for CompTIA CySA+
Treat each CySA+ item as an analyst decision: identify telemetry, scope risk, validate findings, contain impact, communicate clearly, and improve controls.
Core concepts
Concept 1
Malicious activity analysis should combine host, network, application, identity, and cloud evidence.
Exam cue: Correlate host, network, application, identity, and cloud indicators.
Concept 2
Security tools help collect, enrich, triage, and validate evidence but still require analyst judgment.
Exam cue: Choose the tool that validates the hypothesis.
Concept 3
Automation improves consistency when playbooks are tuned, tested, and monitored for false positives.
Exam cue: Automate repeatable tasks with tuning and human escalation points.
Concept 4
AI can accelerate analysis, but its data handling, output quality, access, and accountability require governance.
Exam cue: Validate AI output and protect sensitive evidence with approved data and access controls.
Risk pitfalls and guardrails
Closing an alert because one tool is quiet while other telemetry shows compromise.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Automating containment without testing the business impact.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Treating high alert volume as proof of high risk without tuning.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Sending sensitive incident data to an unapproved AI service or accepting model output without validation.
Guardrail: Avoid answers that destroy evidence, trust scanner output blindly, over-automate containment, omit stakeholders, or report raw tool noise as strategy.
Memory anchors
SIEM
A SIEM centralizes, correlates, and alerts on security telemetry.
EDR
Endpoint detection and response observes endpoint behavior and supports investigation or containment.
Packet Capture
Packet capture records network traffic for protocol and behavior analysis.
NetFlow
NetFlow summarizes network conversations without full packet payloads.
User Behavior
User behavior analytics can highlight unusual identity or access patterns.
False Positive
A false positive is an alert that appears suspicious but is not a true threat.
Tuning
Tuning adjusts detections to reduce noise while preserving useful coverage.
SOAR
SOAR tools orchestrate repeatable security workflows and automate response tasks.
Playbook
A playbook defines repeatable investigation or response steps.
AI Governance
AI governance defines approved use, data handling, validation, access, monitoring, and human accountability.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
Summit Freight's SIEM has separate alerts for a rare PowerShell command on application-server, a new admin role, and an outbound connection to 172.20.14.33 within four minutes. Which recommendation is MOST appropriate? No response action has been taken yet.
EDR on finance-workstation shows winword.exe spawning powershell.exe, which downloads a DLL from 192.0.2.48 and creates a Run key. What should the analyst do FIRST? No response action has been taken yet.
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”