Legacy Haven University

Category: CySA+ (CS0-004)

The CompTIA Cybersecurity Analyst+ (CySA+ CS0-004) certification validates the intermediate, hands-on capabilities required to proactively defend modern enterprise networks and hybrid cloud environments. As security architectures evolve, Security Operations Center (SOC) analysts and threat hunters must bridge telemetry collection with automated defense, behavioral analysis, and threat intelligence.

This resource hub delivers structured study notes, performance-based question (PBQ) review scenarios, and practical SOC playbooks aligned with official CS0-004 exam domains. Explore log analysis techniques across SIEM and EDR platforms, EPSS and SBOM vulnerability prioritization models, incident containment runbooks, and compliance reporting frameworks designed to help you pass the CS0-004 exam and defend critical infrastructure.

  • Integrating Controls: Attack Surface Management & Hardening

    Veteran practitioners master attack surface management by relentlessly shrinking the opportunities adversaries exploit. They treat every exposed asset, protocol, and configuration as a potential entry point and systematically eliminate or fortify those vectors. In CAS-005 terms, this discipline drives secure architecture design, where teams integrate vulnerability management, hardening, and defense-in-depth to deliver resilient systems. Determining…

  • Lab: Securing Docker Images with Trivy Automation

    Vulnerabilities in container images expose organizations to supply chain attacks and runtime exploits. Trivy detects these issues early by scanning for known vulnerabilities, misconfigurations, secrets, and licenses in Docker images and their dependencies. Security teams integrate Trivy into CI/CD pipelines to enforce secure builds and block vulnerable images from reaching production. Prerequisites Install Docker on…

  • Lab: Using Nmap Analysis to Identify Devices and Roles, and Hardening Violations

    Interpret Nmap scan results under strict hardening guidelines by mapping each IP to exactly one primary service on its default port while flagging non-compliant ports and insecure protocols. This lab strengthens your ability to enforce services per device, default-port discipline, and secure-protocol mandates. For comprehensive coverage of advanced security operations and network hardening techniques, visit…

  • Step-by-Step: Configuring a WireGuard VPN Tunnel

    WireGuard delivers modern, lightweight VPN tunnels that secure remote access and support deperimeterization strategies. Practitioners deploy it to enforce zero-trust principles, reduce attack surfaces, and integrate seamlessly into SASE architectures. This tutorial walks you through a production-grade setup on Linux servers and clients. Follow these steps precisely to establish encrypted, high-performance tunnels. Generate Cryptographic Keys…

  • Deperimeterization: SASE vs. SD-WAN Architecture

    Deperimeterization shifts security from rigid network boundaries to identity-driven, context-aware protections that follow users, devices, and data everywhere. Practitioners dismantle traditional castle-and-moat models because modern enterprises operate across clouds, remote locations, and mobile workforces. CompTIA SecurityX (CAS-005) emphasizes this evolution under security architecture objectives, highlighting SASE, SD-WAN, and software-defined networking as core enablers. Architects implement…

  • Tutorial: Automating IaC Security Scans in a CI/CD Pipeline

    Security architects embed IaC scans directly into CI/CD pipelines to shift security left and eliminate misconfigurations before deployment. In CAS-005, you treat infrastructure definitions as code that demands the same rigorous validation as application code. Tools like Checkov integrate seamlessly to enforce policy-as-code and maintain cloud posture across Windows and Linux environments. Link to related…

  • Secure Cloud Architecture: CSPM, CASB, and Shadow IT

    Architects secure cloud environments by integrating tools that enforce visibility, enforce policy, and eliminate blind spots. In CAS-005, you master Cloud Security Posture Management (CSPM), Cloud Access Security Broker (CASB), and Shadow IT detection to maintain control across hybrid and multi-cloud deployments. Link to the full CAS-005 guide: Ultimate Guide to CompTIA SecurityX (CAS-005) Understand…

  • How to Build a PKI Hierarchy from Scratch

    Public Key Infrastructure (PKI) delivers the cryptographic foundation that enforces trust, confidentiality, integrity, and non-repudiation across systems. A properly designed hierarchy isolates risk, scales issuance, and supports Zero Trust principles. Practitioners build these hierarchies to control certificate lifecycles, enforce policy, and contain breaches. Design the Hierarchy First Define clear roles before touching any system. The…

  • Designing Resilient Systems: Zero Trust Architecture (ZTA) Deep Dive

    Veteran practitioners design resilient systems by rejecting implicit trust. Zero Trust Architecture (ZTA) delivers exactly that foundation. It treats every access request as potentially hostile, regardless of origin, and enforces continuous verification. This approach shrinks the attack surface, contains breaches, and sustains operations even under active compromise. ZTA Core Principles Drive Every Decision Architects start…

  • Third-Party Risk: Auditing Your Supply Chain

    Veteran security architects treat third-party dependencies as extensions of their own attack surface. Organizations rely on vendors for cloud services, software components, hardware, and critical operations. Attackers exploit these connections. Effective auditing turns visibility into actionable defense and keeps the supply chain from becoming the weakest link. Define the Core Risks with Precision Supply chain…