CySA+ Log Analysis: Correlate Evidence and Explain the Next Check

Which fields should you read before interpreting a log?

Start CySA+ log analysis by checking the record's source, time basis, actor, affected system, action, and outcome before deciding what happened. CompTIA's CS0-004 objectives 1.1–1.3 cover logging integrity, clock synchronization, suspicious activity, and analysis tools; the objectives document is version 2.0, checked November 3, 2026.

Use this reading order as an editorial practice method, not an official CompTIA scoring checklist:

An account label answers a different question from a person's identity. A successful sign-in and a completed export also describe different actions. Keep those distinctions in your notes instead of replacing every favorable outcome with the word “success.”

Check where these skills sit in the CySA+ objectives and domain map. For broader review around this exercise, full CompTIA CySA+ prep planned for launch is organized across the four domains. First, annotate one record with each field's meaning and any missing context.

How do timestamps and sources affect correlation?

Put events on one time basis before comparing their order. In a practice example, a raw timestamp of 09:03:10 with an explicit offset of −04:00 converts to 13:03:10 UTC. Preserve both values in your working notes so another analyst can check the conversion.

That arithmetic does not establish that the device clock was correct. CompTIA explicitly includes clock synchronization in the logging objectives. If two records appear close together but their clocks have not been checked, describe their apparent order as provisional. Do not silently shift a timestamp until the story fits.

Apply the same discipline to sources. The abstract of NIST's SP 800-92 addresses enterprise logging infrastructure and ongoing processes. It is useful context for treating logging as a managed process, but it does not supply the field definitions for this exercise. Those definitions must come from the records and their stated context.

For each proposed connection, write down the joining evidence: the same defined session, the same resource, or another explicit relationship. Matching account text or an IP value can be a lead without proving that two records concern the same person or attacker. Before building a timeline, mark every unresolved time or identity assumption.

What does the original log example show and leave unknown?

The following records are synthetic teaching material, not live logs or recalled exam questions. Every event occurs on the same fictional day. Times have been normalized to UTC, and “host” means the system recording the event. For this exercise only, Q17 is explicitly defined as the same session in the identity and application records; no vendor-specific field behavior is implied.

A defensible first reading is narrow: the identity log records a rejected sign-in followed by an accepted one for the named account. The defined session Q17 connects the accepted sign-in with a completed application export. Record E reports a backup starting on the application host, but the sample supplies no connection between that operation and Q17.

The records do not establish who controlled the account, whether the export was authorized, where the exported data went, or whether the backup was related. A rejected sign-in followed by acceptance could fit more than one explanation. The example does not justify naming an attacker or declaring confirmed data theft.

Write three separate lines before continuing: an observation supported by named records, a hypothesis worth testing, and an unanswered question. For this sample, those might be “Q17 completed an export,” “the account may have been misused,” and “was this export expected and authorized?”

Which next check separates competing explanations?

Choose a check that could change your interpretation. Collecting more records without a question can leave the central uncertainty unresolved. This is an editorial application of NIST SP 800-61 Revision 3's analysis guidance on determining the sequence, affected assets, and underlying causes.

In this exercise, verifying whether the export was expected is a reasonable starting check because that is the named uncertainty. It is not a universal rule to delay action. If a scenario supplies evidence of continuing harm, follow the authorized response and escalation process while preserving evidence. The CySA+ incident response guide develops those response decisions.

For a separate question about the meaning and confidence of an indicator, use the CySA+ threat intelligence guide. For broader practice, full CompTIA CySA+ prep planned for launch includes 1,350 questions. Finish this exercise by naming the single additional fact that would most change your current conclusion.

How should you preserve the evidence and record your conclusion?

NIST SP 800-61 Revision 3 calls for preserving the integrity and provenance of incident records, documenting investigative actions, and protecting access to sensitive information. Keep the original records available and distinguish them from your normalized timeline and annotations. Follow organizational evidence and retention procedures; this guide does not prescribe one retention period for every environment.

For the synthetic exercise, save a short analysis containing:

1. Evidence used: records B–D and the exercise's definition of Q17.
2. Supported finding: the accepted session is associated with an export of 300 records.
3. Limits: controller identity, authorization, and destination remain unknown.
4. Next check: verify the export request and authorization with the responsible owner.
5. Handling notes: identify the source records, any time conversion, and the changes made in the working copy.

A different analyst should be able to follow the reasoning without mistaking your hypothesis for a recorded fact. Revisit the Security Operations coverage in the CySA+ objectives guide to connect a weak step to the relevant objective.

Use the 20 free CySA+ practice questions for a broader baseline, then schedule another original log exercise with the free CySA+ study plan. For additional term review, full CompTIA CySA+ prep planned for launch includes 500 flashcards.

Your next task is concrete: hide the explanation above, reconstruct the timeline, and write one supported finding, one uncertainty, and one next check. Recheck any sentence that claims more than its cited records show.