2. Security Operations (33%)

Security operations is where detection happens. This phase covers the environment analysts monitor, the signals they look for, and the tools they use to find and investigate threats. At 33% of the exam, it's the single largest domain — master it first.

The three sections in this session build on each other deliberately: architecture (2.1) defines what you're monitoring, indicators (2.2) define what you're looking for, and tools (2.3) define how you find it. Understanding why each layer exists — and where it fails — is what distinguishes an analyst who passes the CySA+ from one who just memorizes tool names.