CompTIA · CySA+ CS0-004
Patterns, scripts, and file formats
CySA+ CS0-004 · Lesson 8 of 22 · 1:04:47
YouTube loads only after you press play. This chapter opens at its timestamp in the full course. Watch on YouTube ↗
In this lesson
Prepare for the CySA+ CS0-004 exam (CompTIA Cybersecurity Analyst (CySA+)). In this lesson: regular expressions, decoding PowerShell's EncodedCommand, email analysis with SPF, DKIM, and DMARC, UEBA, the JSON, XML, YAML, and EVTX formats, and scripting with Python, PowerShell, and shell. Includes three original practice questions.
Preview the topics
- A process creation event shows powershell.exe started by winword.exe, with -NoProfile, -WindowStyle Hidden, and -EncodedCommand followed by a long string. What should the analyst do first?
- An analyst receives a file of Security log events copied from a domain controller, and it opens as unreadable binary data in a text editor. Which format is it most likely?
- An analyst must check 5,000 IP addresses from a firewall log against a threat intelligence API, and add the results to a CSV file every morning. What is the best approach?