CySA+ Labs for 2027: Build Four Evidence Projects Before Test Day

Which lab tasks match the applied CySA+ objectives?

For a 2027 CySA+ target, build four outputs you can explain: annotated evidence, a scan decision record, an incident timeline, and a handover. CompTIA's CS0-004 objectives include scenario-based evidence analysis, vulnerability assessment, incident handling, and reporting, with sample hardware and software for practice.

The objectives and equipment examples were checked November 3, 2026. This plan uses that published scope; verify the exam code and language before booking your 2027 appointment. Start with the CS0-004 objectives and domain map to identify which tasks you need to practice.

Treat each output as a record of a decision. A screenshot shows what a tool displayed; your notes must explain what the evidence supports, what remains unknown, and what you would check next. NIST SP 800-61 Revision 3 supports using incident exercises to evaluate and improve response. The four projects below are original practice suggestions, not CompTIA assignments or recalled exam questions.

Can you start with saved or synthetic artifacts?

Yes. Start with material you own or have explicit permission to use: a saved packet capture, an authorized scan report, or synthetic records with invented people and systems. Wireshark's User's Guide describes opening saved captures and inspecting packet details and bytes. You can practice that inspection without generating new network traffic.

Choose one route for each project:

Keep the original evidence separate from annotations. Record its source, permission, collection context, and any edits made to your working copy. NIST emphasizes preserving records' integrity and provenance; your practice notes should make it possible to trace a conclusion back to the material you inspected.

Do not use employer or customer records simply because you can access them. For this plan, use no live malware and scan no third-party systems. If permission or data handling is unclear, switch to an invented case.

Use the 20 free CySA+ practice questions to identify concepts to revisit alongside the projects. For additional question practice, full CompTIA CySA+ prep planned for launch includes 1,350 questions.

What equipment is optional rather than required?

CompTIA's sample list includes VM-capable workstations, Windows and Linux, SIEM products, packet tools, vulnerability scanners, and cloud access. These are practice examples, not a requirement to buy or install every category.

For the saved-artifact route, choose a computer that can open your selected files and a place to write your decisions. Use Wireshark when inspecting a permitted capture. A synthetic exercise can begin with a text file and written notes; it practices interpretation, although it does not demonstrate that you can configure or operate the corresponding tool.

Add a virtual machine only when the project needs you to perform an action and inspect its result. Before setup, check the current software requirements, your computer's capacity, and the scope of your permission. For an optional cloud lab, check the provider's current charges and resource-removal instructions before creating anything. This plan makes no claim that a particular setup is free.

Keep exam delivery separate from lab setup. Pearson VUE's CompTIA OnVUE rules, checked November 3, 2026, prohibit virtual machines for taking the online exam. A VM used for study does not establish that your test-day computer is suitable; recheck the current delivery requirements before your 2027 booking.

Choose the smallest setup that lets you complete the next output, then begin the task.

What should you produce on four January 2027 checkpoints?

Suppose you choose February 6, 2027 as your target exam date. The dates below are editorial checkpoints, not confirmed appointment availability or a claim that four projects provide complete preparation. Shift them with your own target date.

January 9: explain the evidence. Select a small permitted capture or synthetic log set. Record the timestamps and time zone, source, observed activity, and relevant record locations. Write one supported finding, one plausible alternative explanation, and the next check that could distinguish them. Use the CySA+ log-analysis exercise if you need a method for organizing those notes.

January 16: justify the assessment. State the question the scan should answer and the authorized assets. Choose a method, then inspect a permitted report or run only the authorized lab assessment. Record what the results establish and what they do not. With synthetic findings, label the result as an interpretation exercise, not a scan you performed. Use the scan-type decision guide to separate scope, credentials, and collection method.

January 23: defend the next action. Build an incident timeline from permitted or invented records. Mark missing evidence and explain a proposed response, who can authorize it, and what finding would change your decision. Include recovery checks: NIST recommends checking restoration assets and validating restored integrity and essential services. A statement that a backup exists is not enough to demonstrate those checks.

January 30: transfer the work. Turn the incident into a technical handover and a short leadership update. In this exercise, give the next analyst evidence locations, actions taken, unresolved questions, and the next owner. Give leadership the supported impact, remaining uncertainty, and the decision or update needed. Do not invent impact to make the summary sound decisive.

For terminology that slows your explanations, full CompTIA CySA+ prep planned for launch includes 500 flashcards. Use the free CySA+ study plan to reserve time for completing and revising the outputs.

How can you tell whether an artifact demonstrates understanding?

Review each project against five questions. This is an editorial quality check, not a CompTIA scoring rubric:

1. Can I locate the evidence? Identify the record, packet, report section, or clearly labeled synthetic input.
2. Can I separate facts from inference? Explain which conclusion is directly supported and which remains a hypothesis.
3. Can I explain the decision? Connect the proposed action to the evidence, its limits, and the authority needed.
4. Can I describe verification? State what result would show the action worked or the hypothesis needs revision.
5. Can someone continue the work? Name the unresolved question, next step, and responsible role.

If an output fails one question, revise that part before adding another tool. Then match it to the relevant CySA+ objectives. Four polished files can still leave objectives unpracticed; use the mapping to find those gaps.

What should you recheck before using the lab for final review?

After January 30, revisit the least convincing decision in each project and explain it without copying your original conclusion. Check whether your notes still distinguish observed results from invented inputs, whether permission still covers any further activity, and whether changed software affects your setup.

Confirm that your booked exam code matches the objectives you studied. For weekly time allocation beyond these deliverables, use the 2027 CySA+ study calendar.

Keep question rehearsal alongside practical work: full CompTIA CySA+ prep planned for launch includes an 85-question mock exam. Neither a completed portfolio nor a practice score guarantees a pass. Your next step is to select the first permitted artifact and write the question your January 9 evidence record must answer.