Free CompTIA CySA+ (CS0-004) Roadmap
The blue-team analyst certification and the natural step after Security+. Security operations, vulnerability management, incident response and reporting. Built on CS0-004. CS0-003 can still be booked until 22 December 2026.
6 steps · 14 free videos · 17 free reads
Create your free account to open all 2,396 free items
The 31 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
6 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Learn the analyst body of knowledge
Security operations, vulnerability management, incident response and reporting.
🔒 The full roadmap adds here: 1 full course (Membership)
- Course · TOTAL: CompTIA CySA+ Cybersecurity Analyst (CS0-004) · 🔒 Membership
Step 2 — Threat intelligence and detection
Turn intelligence into detections that fire on real activity.
🔒 The full roadmap adds here: hands-on labs 1–37 of 169 (26 labs in Membership · 11 labs in Infrastructure Labs)
- Lab 1 of 169 · Analyze Various Data Sources to Confirm Suspected Infection · 🔒 Membership
- Lab 2 of 169 · Assessing Vulnerabilities Post Addressal · 🔒 Membership
- Lab 3 of 169 · BitCoin Mining Web Application on Corporate Network · 🔒 Membership
- Lab 4 of 169 · Check for Indicators of Other Attack Activity (Debug PE File) · 🔒 Membership
- Lab 5 of 169 · Cyber Security Evaluation Tool (CSET) · 🔒 Membership
- Lab 6 of 169 · Entering Information into a CMDB · 🔒 Membership
- Lab 7 of 169 · Event Logs with Autopsy · 🔒 Membership
- Lab 8 of 169 · Internet History · 🔒 Membership
- Lab 9 of 169 · MITRE - Defend · 🔒 Membership
- Lab 10 of 169 · Nexpose: Red Team Exploitation · 🔒 Membership
- Lab 11 of 169 · Overview of Kibana · 🔒 Membership
- Lab 12 of 169 · Performing an Initial Attack Analysis · 🔒 Membership
- Lab 13 of 169 · Preparing Target Media · 🔒 Membership
- Lab 14 of 169 · Recover from Illegal Bitcoin Mining Incident · 🔒 Membership
- Lab 15 of 169 · Recover from Web-Based Flashpack Incident · 🔒 Membership
- Lab 16 of 169 · Report Writing for Presentation to Management · 🔒 Membership
- Lab 17 of 169 · Respond to and Validate Alerts from Antivirus Software · 🔒 Membership
- Lab 18 of 169 · WMI Event Persistence · 🔒 Membership
- Lab 19 of 169 · Comprehensive Threat Response · 🔒 Membership
- Lab 20 of 169 · Conduct Supplemental Monitoring · 🔒 Membership
- Lab 21 of 169 · Create Custom Snort Rules · 🔒 Membership
- Lab 22 of 169 · MITRE - Attack · 🔒 Membership
- Lab 23 of 169 · Monitoring for False Positives · 🔒 Membership
- Lab 24 of 169 · Monitoring Network Traffic · 🔒 Membership
- Lab 25 of 169 · Monitoring Network Traffic for Potential IOA/IOC · 🔒 Membership
- Lab 26 of 169 · SNORT Configuration and Operation Lab · 🔒 Membership
- Lab 27 of 169 · Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 169 · Use SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 29 of 169 · Use Wireshark Filters to Explore Captured Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 169 · Perform Application Source Code Verification [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 169 · Perform Log Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 32 of 169 · Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 33 of 169 · Assess Cybersecurity Templates and Benchmarks [Guided] · 🔒 Infrastructure Labs
- Lab 34 of 169 · Can You Discover Vulnerabilities Over a Network? [Advanced] · 🔒 Infrastructure Labs
- Lab 35 of 169 · Can You Establish Secure Communications by Using SSH and Wireshark? [Advanced] · 🔒 Infrastructure Labs
- Lab 36 of 169 · Can You Manage Threats by Using Source Code, Logs, and Security Templates? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 169 · Can You Reduce Threats by Using Nmap, SSH, Source Code Analysis, and Security Templates? [Expert] · 🔒 Infrastructure Labs
Step 3 — Log analysis and SIEM
Correlate across sources and find the signal.
🔒 The full roadmap adds here: hands-on labs 38–57 of 169 (9 labs in Membership · 11 labs in Infrastructure Labs)
- Lab 38 of 169 · Utilize Network Analysis Tools [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 169 · Use Security Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 40 of 169 · Perform Email Header Analysis [Guided] · 🔒 Infrastructure Labs
- Lab 41 of 169 · Evaluate Network Logging [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 169 · Display Files by Performing Forensic Analysis Tasks [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 169 · Evaluate the Output of Enumeration Tools [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 169 · Evaluate Credential Security [Guided] · 🔒 Infrastructure Labs
- Lab 45 of 169 · Can You Capture and Analyze Network Traffic and Logging by Performing Management Tasks? [Advanced] · 🔒 Infrastructure Labs
- Lab 46 of 169 · Can You Evaluate Account Security Threats? [Advanced] · 🔒 Infrastructure Labs
- Lab 47 of 169 · Can You Perform Forensic Analysis Tasks to Display Files? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 169 · Can You Capture and Analyze Network Traffic? [Expert] · 🔒 Infrastructure Labs
- Lab 49 of 169 · Event Log Collection with QRadar · 🔒 Membership
- Lab 50 of 169 · QRADAR - Auditing Service Accounts and Generating SIEM Reports · 🔒 Membership
- Lab 51 of 169 · QRadar - Centralized Monitoring · 🔒 Membership
- Lab 52 of 169 · QRADAR - Collecting Logs and Verifying Syslog Aggregation with pfSense · 🔒 Membership
- Lab 53 of 169 · QRadar - IDS Setup and Configuration · 🔒 Membership
- Lab 54 of 169 · QRadar - Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 55 of 169 · QRadar - Log Correlation & Analysis to Identify Potential IOC with Custom Log Types · 🔒 Membership
- Lab 56 of 169 · QRADAR - Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 57 of 169 · QRadar - Snort Signatures, IDS Tuning, and Blocking · 🔒 Membership
Step 4 — Vulnerability management
Scan, interpret, prioritise and drive remediation.
🔒 The full roadmap adds here: hands-on labs 58–115 of 169 (28 labs in Membership · 30 labs in Infrastructure Labs)
- Lab 58 of 169 · Perform Network Scanning and Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 59 of 169 · Implement Intrusion Detection by Using Wazuh [Guided] · 🔒 Infrastructure Labs
- Lab 60 of 169 · Configure and Manage SSH to Establish Secure Connections [Guided] · 🔒 Infrastructure Labs
- Lab 61 of 169 · Manage Incidents by Using Incident Response Tools [Guided] · 🔒 Infrastructure Labs
- Lab 62 of 169 · Configure Secure HTTP Services [Guided] · 🔒 Infrastructure Labs
- Lab 63 of 169 · Configuring VPN Services [Guided] · 🔒 Infrastructure Labs
- Lab 64 of 169 · Can You Improve Security by Using Network Scanning, Sniffing, and GPOs? [Advanced] · 🔒 Infrastructure Labs
- Lab 65 of 169 · Can You Implement Intrusion Detection by Using Wazuh? [Advanced] · 🔒 Infrastructure Labs
- Lab 66 of 169 · Can You Improve Network Security with SSH, HTTPS, and IPSec? [Advanced] · 🔒 Infrastructure Labs
- Lab 67 of 169 · Can You Use Snort and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 68 of 169 · Analyze and Update a Company BCP/BIA/DRP/CIRP · 🔒 Membership
- Lab 69 of 169 · Analyze SQL Injection Attack · 🔒 Membership
- Lab 70 of 169 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 71 of 169 · Centralized Monitoring · 🔒 Membership
- Lab 72 of 169 · Conduct Log Analysis and Cross Examination for False Positives · 🔒 Membership
- Lab 73 of 169 · Core Impact Web Application Penetration Testing · 🔒 Membership
- Lab 74 of 169 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
- Lab 75 of 169 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 76 of 169 · Firewall Setup and Configuration · 🔒 Membership
- Lab 77 of 169 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 78 of 169 · Identify Whether High-Risk Systems Were Affected · 🔒 Membership
- Lab 79 of 169 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
- Lab 80 of 169 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 81 of 169 · Manual Vulnerability Assessment · 🔒 Membership
- Lab 82 of 169 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 83 of 169 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 84 of 169 · Network Discovery · 🔒 Membership
- Lab 85 of 169 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 86 of 169 · Open Source Password Cracking · 🔒 Membership
- Lab 87 of 169 · Penetration Tester Challenge · 🔒 Membership
- Lab 88 of 169 · Phishing · 🔒 Membership
- Lab 89 of 169 · Preliminary Scanning · 🔒 Membership
- Lab 90 of 169 · Threat Designation · 🔒 Membership
- Lab 91 of 169 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 92 of 169 · Vulnerability Proof of Concept and Remediation · 🔒 Membership
- Lab 93 of 169 · Vulnerability Scanning with GVM · 🔒 Membership
- Lab 94 of 169 · Windows System Hardening with Group Policy & Active Directory · 🔒 Membership
- Lab 95 of 169 · Windows System Hardening with PowerShell · 🔒 Membership
- Lab 96 of 169 · Use Reconnaissance Tools to Perform Network Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 97 of 169 · Perform Network Scanning to Find Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 169 · Implement a Host-Based Intrusion Detection System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 169 · Implement Snort to Evaluate Network Communications [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 169 · Harden Network Security [Guided] · 🔒 Infrastructure Labs
- Lab 101 of 169 · Perform Web Server Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 169 · Establish Secure Communications Between Systems by Using SSH for Remote Access [Guided] · 🔒 Infrastructure Labs
- Lab 103 of 169 · Can You Perform Network and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 104 of 169 · Can You Implement a Host-Based Intrusion Detection System? [Advanced] · 🔒 Infrastructure Labs
- Lab 105 of 169 · Can You Manage Network, Web, and Remote Access Security? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 169 · Can You Use Snort, IPSec, Wireshark, Nikto, Nmap, and Wapiti to Identify Network Vulnerabilities? [Expert] · 🔒 Infrastructure Labs
- Lab 107 of 169 · Using the OWASP Zed Attack Proxy Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 108 of 169 · Using the Burp Suite Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 109 of 169 · Use the Nikto Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 110 of 169 · Use the Arachni Web Application Scanner [Guided] · 🔒 Infrastructure Labs
- Lab 111 of 169 · Use Web Application Scanners [Advanced] · 🔒 Infrastructure Labs
- Lab 112 of 169 · Use Greenbone Security Manager to Identify Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 113 of 169 · Use Nmap for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 114 of 169 · Use hping for Enumeration [Guided] · 🔒 Infrastructure Labs
- Lab 115 of 169 · Use Responder for Enumeration [Guided] · 🔒 Infrastructure Labs
Step 5 — Incident response
Work an incident end to end, then restore and recover.
🔒 The full roadmap adds here: 1 full course · hands-on labs 116–146 of 169 (course in Membership · 20 labs in Membership · 11 labs in Infrastructure Labs)
- Course · CompTIA CySA+ Labs · 🔒 Membership
- Lab 116 of 169 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 117 of 169 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 118 of 169 · Cryptography: Steganography · 🔒 Membership
- Lab 119 of 169 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 120 of 169 · Data Recovery with Autopsy · 🔒 Membership
- Lab 121 of 169 · Dynamic Malware Analysis · 🔒 Membership
- Lab 122 of 169 · Hash Verification · 🔒 Membership
- Lab 123 of 169 · Implement Single System Changes in Firewall · 🔒 Membership
- Lab 124 of 169 · Installing Patches and Testing Software · 🔒 Membership
- Lab 125 of 169 · Introduction to Squert · 🔒 Membership
- Lab 126 of 169 · Log Event Reports · 🔒 Membership
- Lab 127 of 169 · Microsoft Baseline Security Analyzer · 🔒 Membership
- Lab 128 of 169 · Network Topology Generation · 🔒 Membership
- Lab 129 of 169 · Recover from Incident · 🔒 Membership
- Lab 130 of 169 · Setting up Filters and Queries in Kibana · 🔒 Membership
- Lab 131 of 169 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 132 of 169 · Validate Indications of Compromise: Analysis of PE File · 🔒 Membership
- Lab 133 of 169 · Vulnerability Analysis/Protection · 🔒 Membership
- Lab 134 of 169 · WebApp Attack PCAP Analysis · 🔒 Membership
- Lab 135 of 169 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 136 of 169 · Perform Log Analysis and Task Automation [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 169 · Perform Backup Options to Allow for Lost File Restoration [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 169 · Implement New Security Policies [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 169 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 169 · Find Network System Vulnerabilities [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 169 · Evaluate and Customize Security Policy Templates [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 169 · Perform Open Source Intelligence (OSINT) Gathering Operations [Guided] · 🔒 Infrastructure Labs
- Lab 143 of 169 · Can You Manage Logs with Scripts, Perform File Restoration, and Perform Vulnerability Scans? [Advanced] · 🔒 Infrastructure Labs
- Lab 144 of 169 · Can You Use GPOs and Security Templates as Part of IR? [Advanced] · 🔒 Infrastructure Labs
- Lab 145 of 169 · Can You Examine Network Communications by Using Incident Response Tools? [Advanced] · 🔒 Infrastructure Labs
- Lab 146 of 169 · Can You Perform File Restoration, Manage GPOs, and Perform OSINT? [Expert] · 🔒 Infrastructure Labs
Step 6 — Report and communicate
Write the vulnerability and incident reports, recommendations and management briefings the analyst owns.
Hands-on step: the labs for it are on the full roadmap.
🔒 The full roadmap adds here: hands-on labs 147–169 of 169 (Membership)
- Lab 147 of 169 · Additional Scanning Options · 🔒 Membership
- Lab 148 of 169 · Advanced Techniques for Malware Recovery · 🔒 Membership
- Lab 149 of 169 · Analysis and Recommendation Report · 🔒 Membership
- Lab 150 of 169 · Analyze and Classify Malware · 🔒 Membership
- Lab 151 of 169 · CIRP Creation and Disaster · 🔒 Membership
- Lab 152 of 169 · Collecting Logs and Verifying Syslog Aggregation · 🔒 Membership
- Lab 153 of 169 · Conduct Root Cause Analysis for System Crashes · 🔒 Membership
- Lab 154 of 169 · Creating SIEM Reports with Splunk · 🔒 Membership
- Lab 155 of 169 · Disable User Account on Windows 10 · 🔒 Membership
- Lab 156 of 169 · Identifying Malicious Network Connections · 🔒 Membership
- Lab 157 of 169 · IDS Setup and Configuration · 🔒 Membership
- Lab 158 of 169 · Linux Users and Groups · 🔒 Membership
- Lab 159 of 169 · Log Analysis · 🔒 Membership
- Lab 160 of 169 · Log Correlation · 🔒 Membership
- Lab 161 of 169 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 162 of 169 · Parse Files Out of Network Traffic · 🔒 Membership
- Lab 163 of 169 · Protect Against Beaconing · 🔒 Membership
- Lab 164 of 169 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 165 of 169 · Searching for Indicators of Compromise · 🔒 Membership
- Lab 166 of 169 · Setting Up SYSLOG Forwarding From a Windows System · 🔒 Membership
- Lab 167 of 169 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
- Lab 168 of 169 · Vulnerability Scanner Set-up and Configuration with OpenVAS · 🔒 Membership
- Lab 169 of 169 · Whitelist Comparison · 🔒 Membership
Try a free SOC lab: Shut the door (~4 min) → A scripted simulation in your browser. No account needed.
Exam and next steps
Before the exam
Do it hands-on
The full CompTIA CySA+ (CS0-004) roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 31 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.