CySA+ is CompTIA's intermediate cybersecurity analyst certification, built for people who work in, or want to move into, a security operations center (SOC) or a vulnerability management team. It proves you can detect and analyze indicators of malicious activity, run vulnerability management and incident response processes, and communicate findings to the people who need to act on them. CompTIA describes the target candidate as having about four years of hands-on experience as a level 2 SOC analyst or vulnerability analyst, but that is a recommendation, not a requirement.
CS0-004 (CySA+ V4) launched on June 23, 2026 and is the current version. The English CS0-003 exam retires on December 22, 2026, so if you are starting from scratch, study for CS0-004. The biggest change is a new objective on AI in security operations, and CompTIA also highlights expanded coverage of EPSS for vulnerability prioritization, ZTNA and SASE, and software supply chain topics like SBOM.
Use this guide as a map. Check the domain weights, follow the 8-week plan (or stretch it), and give extra attention to the most-missed topics. Keep CompTIA's official CS0-004 exam objectives PDF open the whole time and treat it as your checklist: if a tool or concept is listed there, expect to see it.
The exam at a glance
| Exam code | CS0-004 (CySA+ V4) |
|---|---|
| Questions | Maximum of 85 |
| Time | 165 minutes |
| Passing score | 750 on a scale of 100-900 |
| Question types | Multiple-choice and performance-based (PBQs) |
| Price (US voucher) | $439 CompTIA retail (raised from $425 in mid 2026) |
| Prerequisites (CompTIA's recommendation) | None required. CompTIA recommends about 4 years of hands-on experience as a SOC analyst (level 2) or vulnerability analyst |
| Previous version (CS0-003 retirement) | English CS0-003 retires December 22, 2026; translated versions retire March 23, 2027 |
What each domain tests
Security Operations
34%The largest domain: how systems, networks, and identity work from a SOC perspective, how to spot malicious activity, and which tools confirm it.
- Logging concepts: ingestion, integrity, time synchronization, retention
- Network, host, cloud, identity, and email indicators (impossible travel, LOLBins, BEC)
- Tools: Wireshark, tcpdump, Zeek, SIEM, EDR/XDR, CyberChef, YARA, sandboxes
- Threat intel and hunting: MITRE ATT&CK, Pyramid of Pain, atomic vs behavioral IoCs, STRIDE
- Process improvement: playbooks, SOAR, alert tuning, APIs and webhooks
- AI in the SOC: hallucinations, data exposure, model poisoning, malicious prompts, usage policies
Vulnerability Management
26%Planning and running scans, reading tool output, and deciding what to fix first and how.
- Scan types: credentialed vs non-credentialed, agent vs agentless, passive vs active
- Reading output from Nmap, Nessus, OpenVAS, Nuclei, Burp Suite, ZAP, and Nikto
- Cloud assessment tools: ScoutSuite, Prowler, Trivy, Checkov
- Prioritization: CVSS metrics, EPSS, exploitability, asset value, active exploitation
- Mitigation: patching, compensating controls, exceptions, validating remediation
- Control types and functions, risk strategies, SAST/DAST, SBOM and SCA
Incident Response and Management
24%Attack methodology frameworks, the incident response lifecycle, and the hands-on techniques of working an incident.
- Cyber Kill Chain, Diamond Model of Intrusion Analysis, MITRE ATT&CK
- IR phases: preparation, detection, analysis, containment, eradication, recovery, post-incident
- Triage, timelines, severity and impact, prioritization, escalation
- Evidence: chain of custody, data integrity validation, preservation, legal hold
- Isolation, remediation, restoration, root cause analysis
- IR plans, playbooks, defined roles, tabletop and simulation exercises
Reporting and Communication
16%Turning vulnerability and incident findings into reports, metrics, and communication the right stakeholders can act on.
- Vulnerability scan reports, compliance findings, risk scorecards, action plans
- Inhibitors to remediation: legacy systems, business process interruption, contracts
- Incident communication: legal, PR, regulators, law enforcement, customers
- Executive summaries, after action reports, lessons learned
- Metrics: mean time to detect, respond, remediate, and close; false-positive rate
- Shift handover and internal threat intelligence reports
Study plan
Plan on 8 to 10 hours a week for 8 weeks if you already have Security+ level knowledge and some hands-on exposure. If you work in a SOC today, you can move faster through Security Operations and spend the saved time on vulnerability scanning tools and reporting, which daily alert triage may not touch. If you are newer to the field, stretch the plan to 10 to 12 weeks and build a small lab (a Kali VM, a vulnerable target like Metasploitable, and a free SIEM), which matches the sample hardware and software list CompTIA publishes with the objectives.
- Weeks 1-2
Security operations foundations
Read objectives 1.1 and 1.2 line by line and write a one-line definition for anything unfamiliar. Focus on logging concepts, IAM and PAM, ZTNA and SASE, OT and ICS basics, and the indicators CompTIA lists for network, host, cloud, identity, and email activity. End each session with 15 to 20 Security Operations practice questions on CyberExamPrep so you see how indicators appear inside scenarios.
- Week 3
Tools, threat intel, and AI
Open a sample packet capture in Wireshark, run tcpdump with a few filters, and decode a Base64 string in CyberChef. Learn what question each tool category answers (reputation, file analysis, sandboxing, UEBA) and practice reading short Python, PowerShell, and shell snippets for malicious intent. Then cover objective 1.4 (ATT&CK, Pyramid of Pain, IoC types, STRIDE), 1.5 (SOAR, playbooks, tuning), and the new 1.6 on AI risks, governance, and use cases.
- Weeks 4-5
Vulnerability management
Run Nmap and OpenVAS or Nessus against a lab target and read the output until you can explain every finding. Practice ranking a list of vulnerabilities using CVSS, EPSS, asset value, exposure, and patch availability. Finish with objective 2.4: control types and functions, risk terms like inherent and residual risk, SAST vs DAST, and SBOM.
- Week 6
Incident response
Memorize the seven IR phases in CompTIA's order and list two actions that belong in each. Compare the Cyber Kill Chain, Diamond Model, and ATT&CK until you can tell which one a question describes. Walk through a tabletop scenario on paper: triage, timeline, containment, evidence handling, and root cause. If the frameworks blur together, ask Aurora, the CyberExamPrep AI tutor, to quiz you with short scenarios.
- Week 7
Reporting and your first full mock
Study domain 4: who gets told what during an incident, what belongs in an executive summary versus an after action report, and what each SOC metric measures. Then take a full timed mock exam and use the domain score report to pick your two weakest areas for focused review.
- Exam week
Final review
Take one more timed mock early in the week and review every miss, including the questions you guessed right. Run through the acronym list from the objectives with flashcards and do a few PBQ-style exercises. Stop heavy studying the day before, confirm your appointment and ID, and get a full night of sleep.
Most-missed topics
These concepts look alike on paper, which is exactly why they trip people up. Know the difference cold.
- Atomic vs behavioral IoCs (and the Pyramid of Pain)
- CS0-004 splits indicators of compromise into atomic (a single value like a hash, IP, or domain) and behavioral (a pattern, like an Office process spawning PowerShell). Questions often hinge on which indicator stays useful after an attacker changes infrastructure. The Pyramid of Pain gives the answer: hashes and IPs are trivial to change, TTPs are not.
- CVSS severity vs real priority
- Know the CVSS base metrics well enough to read a vector string: attack vector, attack complexity, privileges required, user interaction, and the confidentiality, integrity, and availability impacts. But a high score alone does not decide priority. The objectives expect you to weigh EPSS likelihood, active exploitation, asset value, exposure (internal, external, isolated), and whether a fix exists.
- True and false positives and negatives
- A false positive is a finding or alert that is not real; a false negative is a real issue your tool missed, and it is usually the more dangerous one. Practice the scenario wording, such as a scanner flagging a flaw on an already patched host, or a credentialed scan revealing what an earlier non-credentialed scan missed.
- Incident response phase order
- CS0-004 lists seven phases: preparation, detection, analysis, containment, eradication, recovery, and post-incident. Many questions ask for the next step, so know that you contain before you eradicate and that lessons learned and root cause analysis come after recovery. Writing playbooks and running tabletop exercises belong to preparation.
- Cyber Kill Chain vs Diamond Model vs MITRE ATT&CK
- The Kill Chain is a linear sequence of attacker stages. The Diamond Model relates four features of an intrusion: adversary, capability, infrastructure, and victim. ATT&CK is a detailed matrix of tactics and techniques that defenders use for detection mapping and heat maps.
- SIEM vs SOAR vs EDR/XDR
- A SIEM collects and correlates logs and raises alerts. SOAR acts on alerts with playbooks and automation, so it is the answer when a scenario is about cutting repetitive analyst work. EDR detects and responds on endpoints, while XDR extends detection and response across endpoints, network, cloud, and email.
- Control types vs control functions
- CS0-004 lists control types as administrative, technical, and physical, and control functions as preventative, detective, responsive, and corrective. A firewall rule is technical and preventative; an acceptable use policy is administrative. If you started with CS0-003 material, note that it used the older managerial, operational, and technical categories.
- Choosing the right scan type
- Credentialed vs non-credentialed, agent vs agentless, and passive vs active come up in scenarios with constraints like fragile OT devices, segmented networks, or regulatory scans. Credentialed scans see more and tend to produce fewer false positives, while passive scanning is the safer choice when active probing could disrupt ICS or SCADA systems.
How to handle PBQs
CySA+ mixes multiple-choice questions with performance-based questions (PBQs) that ask you to do analyst work instead of recalling a fact. CompTIA says PBQ tasks may include analyzing SIEM alerts, reviewing logs and security events, investigating indicators of compromise, prioritizing vulnerabilities, supporting incident response, and recommending remediation. In practice, that means reading raw output such as log lines, scan results, packet details, or command snippets and making a decision based on what it shows. CompTIA does not publish how many PBQs appear on each exam, so practice the format until it feels routine.
- Read the task and look at every tab, pane, or file before you start answering. The instructions usually tell you exactly what to identify, and some of the data is there only to distract you.
- Scan logs for the fields that matter: timestamps, source and destination IPs, ports, usernames, and process and parent process names. Repeated failed logins followed by a success, odd hours, and unexpected ports are classic tells.
- For scan output, confirm a finding actually applies to that host (OS, version, open service) before trusting it, then prioritize by exposure and asset value, not just the highest CVSS number.
- Know what normal looks like for common commands and scripts, so encoded PowerShell, LOLBin abuse, or a download piped straight into a shell stands out.
- Budget your time. If a PBQ is eating more than about 10 minutes, enter your best answer, flag it, and come back after the multiple-choice questions.
- Practice in a simulated environment. The PBQ labs at pbq.cyberexamprep.com let you work hands-on tasks in an exam-style interface, so the format is not new on test day.
Exam day
- Pick your delivery method: a Pearson VUE test center or OnVUE online proctoring from home. Choose the setting where you focus best and are least likely to be interrupted.
- Bring the right ID. The name on it must match your registration exactly. OnVUE requires a valid, unexpired, government-issued photo ID, and CompTIA's in-person guidance asks for two valid forms of ID at a test center. Check CompTIA's current Candidate ID Policy a few days before.
- Check in early. For OnVUE, start check-in 30 minutes before your appointment to run the system check, take ID photos, and complete a room scan. At a test center, arrive at least 15 minutes early.
- You must accept the CompTIA Candidate Agreement before the exam starts. It includes confidentiality terms, so you cannot share or discuss specific exam questions afterward.
- Use flag for review. If a question stalls you, choose your best answer, flag it, and move on. Do not leave anything blank, since an unanswered question cannot earn credit.
- Do the pacing math: 165 minutes for up to 85 questions is just under 2 minutes per question. Aim for about 1 minute on most multiple-choice items to bank time for PBQs, and at the halfway point (around question 43) try to have at least 80 minutes left.
- OnVUE does not allow scratch paper but gives you a built-in digital whiteboard. Use it early to jot down anything you tend to mix up, like the IR phase order or CVSS metric names.
FAQ
- How long does it take to study for CySA+?
- Most candidates with Security+ spend 2-3 months studying. With consistent daily practice, 8-10 weeks is achievable.
- Is CySA+ worth it?
- Yes, especially if you're working in or targeting a SOC analyst or blue team role. It fills the gap between Security+ (knowledge) and the actual analytical work done in security operations.
- What resources does CompTIA recommend?
- CompTIA recommends CertMaster Learn, but our platform's scenario-based practice questions are specifically designed to match the CS0-004 exam style at a fraction of the cost.
- Should I get CySA+ or PenTest+ first?
- If you're pursuing defensive/blue team work, do CySA+ first. If you want offensive/red team work, go PenTest+. They complement each other well and many professionals eventually get both.