CompTIA · CySA+ CS0-004
Logging and operating systems
CySA+ CS0-004 · Lesson 1 of 22 · 3:17
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: log ingestion, parsing, and configuration, protecting logs and synchronizing clocks with NTP, log retention, system hardening from CIS Benchmarks and configuration drift, critical files and registry keys, the Windows and Linux file structures, and the normal shape of system processes like LSASS, svchost, and systemd, with Windows events 4624, 4625, and 4688. Includes three original practice questions.
Preview the topics
- During an investigation, events from the VPN server appear seven minutes after the matching domain controller events, and the timeline is impossible to follow. What should the team fix first?
- File integrity monitoring on a Linux web server reports that /etc/shadow became readable by every user an hour ago. Why does this matter most?
- A server’s process list shows lsass.exe running twice: once from System32, and once from a temporary folder, started by a user’s PowerShell session. What does this most likely indicate?