Exam CS0-004
CompTIA CySA+
Advance your cybersecurity career with threat detection and analysis skills.
- Questions
- Up to 85 questions
- Time
- 165 minutes
- Passing score
- 750 (on a scale of 100-900)
- Exam price (US)
- $439 USD
Security Operations
An organization uses an EDR tool that lacks a native integration with their ticketing system. The security engineer wants to ensure that any 'Critical' severity alert automatically generates a ticket with the relevant host data. Which of the following is the most effective approach?
Vulnerability Management
A vulnerability is discovered with a CVSS Base Score of 7.5. The Attack Vector (AV) metric is 'Network' (N). If the organization implements a firewall rule that restricts access to the vulnerable service to only one specific trusted internal IP, which CVSS metric is primarily affected in the Environmental score?
Incident Response
While conducting a post-incident review, an analyst discovers that a web server was compromised via a known SQL injection vulnerability that had been identified in a scan six months prior but never patched. Which of the following identifies the primary objective of this specific finding in the final report?
CySA+ exam domains
34%
Security Operations
Log analysis, SIEM, threat hunting, and security monitoring workflows
26%
Vulnerability Management
Scanning, prioritization, remediation, and vulnerability lifecycle
24%
Incident Response and Management
IR process, forensics, containment, eradication, and recovery
16%
Reporting and Communication
Vulnerability reports, dashboards, and communicating risk to stakeholders
About CySA+
CompTIA CySA+ (Cybersecurity Analyst) validates skills in threat detection, vulnerability management, and incident response. It sits between Security+ and SecurityX (formerly CASP+), making it the ideal next step after Security+.
How we help you pass
800+ practice questions
Every CySA+ domain, with a detailed explanation for each answer.
Timed mock exams
Full-length exam simulations with a score breakdown by domain, so you know where to focus.
350+ flashcards
Key terms and acronyms with spaced repetition, so they stick.
Aurora AI tutor
Ask about any CySA+ question or concept and get a plain-English explanation.
Frequently asked questions
- What is CompTIA CySA+ CS0-004?
- CS0-004 (CySA+ V4) is the current version of CompTIA CySA+, released in 2026. It keeps the same four domains as CS0-003 with updated weights, and focuses on security operations, threat detection and security operations center (SOC) workflows. The English CS0-003 exam retires on December 22, 2026.
- Should I get Security+ before CySA+?
- Yes, Security+ is the recommended prerequisite. CySA+ builds on Security+ knowledge, diving deeper into threat detection, vulnerability management, and incident response.
- What jobs does CySA+ qualify me for?
- SOC Analyst (Tier II/III), Threat Intelligence Analyst, Vulnerability Analyst, Security Engineer, and Incident Responder. It is also approved for DoD 8140 cyberspace work roles (DoD 8140 replaced the older 8570 IAT levels).
- How hard is CySA+ compared to Security+?
- CySA+ is generally considered harder than Security+ due to its focus on application and analysis rather than recall. Expect more scenario-based questions requiring you to interpret logs and choose remediation steps.
- How long should I study for CySA+?
- Most candidates with Security+ experience study 2-3 months. Focus heavily on SIEM tools, vulnerability scanning output interpretation, and the incident response lifecycle.
Practice CySA+ PBQs
Performance-based questions (PBQs) are the hands-on simulations on the real exam. Practice them in our PBQ labs.
More CySA+ resources
Ready to pass CySA+?
Practice by domain, take timed mock exams and see exactly where to focus next.
Get started