CompTIA · CySA+ CS0-004
Application, cloud, identity, and email indicators
CySA+ CS0-004 · Lesson 5 of 22 · 34:29
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: service disruption and anomalous application use like mass exports and injection attempts, cloud indicators like unusual API activity, disabled logging, unexpected resources, and cost spikes, identity indicators like unexpected resets, MFA changes, and impossible travel, social engineering with typosquatting and URL shorteners, business email compromise, and correlation across sources. Includes three original practice questions.
Preview the topics
- Tidewell’s cloud bill triples overnight: forty large GPU instances appeared in a Region the credit union never uses, created with an access key of a former contractor. What does this most likely indicate?
- The finance team receives an email in the CEO’s name, asking for an urgent wire transfer to a new supplier, and the reply-to address uses tidewe11.com, with two ones instead of two Ls. Which attack is this?
- A teller’s account signs in from Lisbon at 9:00, then from Chicago at 9:20, and neither sign-in uses a VPN. What is the most likely explanation?