CompTIA CySA+
CompTIA CySA+ (CS0-004) is CompTIA's Tier 2 SOC analyst credential. Four domains spanning security operations, vulnerability management, incident response, and reporting / communication. 85 multiple-choice and performance-based questions, 165 minutes, passing score 750 on a scaled 100-900 scale. DoD 8140 approved for Cyber Defense Analyst and Cyber Defense Incident Responder work roles.
Exam fee at last check: $404, per the vendor. The official objectives are at lecbyo.files.cmp.optimizely.com/download/68b1eae88e5011f08868a275d699e612. Verified 2026-05-22.
CS0-004 is the live CySA+ exam, in force since 2026-06-23.
- CS0-004: up to 85 questions, 165 minutes, passing score 750 on a scale of 100 to 900.2
- CS0-004 domain weights: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%.2
- CS0-004 adds an objective on AI in security operations: AI risks, governance, and use cases such as log analysis and event correlation.2
- CS0-003 retires in English on 2026-12-22. The Japanese, Portuguese and Spanish versions retire on 2027-03-23.3
The 40 practice questions on this page were written for CS0-003. Its four domains carry over to CS0-004 with the new weights shown here and on the exam. CS0-004 adds one objective on AI in security operations that no question here covers yet.
Sources, checked 2026-10-07
Get an email if the CompTIA CySA+ exam changes
Common questions about the exam change
- When does the new CompTIA CySA+ exam start?
- CS0-004 launches: 2026-06-23. Source: CompTIA CySA+ V4 (CS0-004), checked 2026-10-07.
- When does the old CompTIA CySA+ exam retire?
- CS0-003 retires in English: 2026-12-22. CS0-003 retires in Japanese, Portuguese and Spanish: 2027-03-23. Source: CompTIA CySA+ V4 (CS0-004), checked 2026-10-07.
- What changed in the CompTIA CySA+ exam?
- CS0-004: up to 85 questions, 165 minutes, passing score 750 on a scale of 100 to 900. CS0-004 domain weights: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%. CS0-004 adds an objective on AI in security operations: AI risks, governance, and use cases such as log analysis and event correlation. CS0-003 retires in English on 2026-12-22. The Japanese, Portuguese and Spanish versions retire on 2027-03-23. Source: CompTIA CySA+ V4 (CS0-004), checked 2026-10-07.
- Which version of the CompTIA CySA+ exam do the practice questions follow?
- The 40 practice questions on this page were written for CS0-003. Its four domains carry over to CS0-004 with the new weights shown here and on the exam. CS0-004 adds one objective on AI in security operations that no question here covers yet.
- Starts CS0-004 launches
- Retires CS0-003 retires in English
- Retires CS0-003 retires in Japanese, Portuguese and Spanish
- Security Operations34%
- Vulnerability Management26%
- Incident Response and Management24%
- Reporting and Communication16%
Source: CompTIA CySA+ V4 (CS0-004). Checked 2026-10-07. Bar length is relative to the heaviest domain; the figure beside each name is the published weight.
Practice is free. The full analysis adds the right answer, the explanation and the source for every question, readiness by domain and a study plan, for one payment.
What's on the exam
Security Operations 34%
The largest domain. Log analysis, monitoring, threat hunting, SIEM tradecraft, malware analysis fundamentals.
- Log sources: Windows event logs, syslog, EDR telemetry, network flow
- SIEM correlation rules and query languages (KQL, SPL)
- Threat hunting hypotheses and methodology
- Network analysis: PCAP review, IDS/IPS tuning
- Malware analysis: static, dynamic, sandbox analysis
- AI in security operations (new in CS0-004): risks (hallucinations, data exposure, model poisoning, malicious prompts), governance (legal or regulatory compliance, AI usage policies), and use cases such as log analysis, event correlation and incident investigation
Primary sources: CompTIA CySA+ CS0-004 V4 exam objectives, MITRE ATT&CK, NIST SP 800-92 Log Management
Vulnerability Management 26%
Discovery, analysis, prioritization, validation, and reporting of vulnerabilities.
- Scanning: authenticated vs unauthenticated, agent-based, OSINT
- CVSS v3.1 and v4.0 scoring
- EPSS for exploitation prioritization
- CISA Known Exploited Vulnerabilities (KEV) catalog
- Validation: false-positive analysis, exploit proof-of-concept
Primary sources: NIST SP 800-115 Technical Guide to Security Testing, EPSS by FIRST, CISA KEV catalog
Incident Response and Management 24%
NIST SP 800-61 Rev. 2 lifecycle applied at Tier 2 depth.
- Preparation, detection and analysis, containment, eradication, recovery, post-incident
- Containment strategies: short-term vs long-term, isolation, evidence preservation
- Evidence handling: order of volatility (RFC 3227), chain of custody
- Lessons-learned process and after-action reporting
Primary sources: NIST SP 800-61 Rev. 2, RFC 3227
Reporting and Communication 16%
How to communicate findings to technical and non-technical audiences.
- Vulnerability report structure, severity classification, remediation timeline
- Stakeholder identification and audience-appropriate communication
- Compliance reporting: GDPR Article 33, SEC cybersecurity disclosure, HIPAA breach notification
- Metrics and KPIs for SOC and vulnerability management programs
Primary sources: SEC Cybersecurity Disclosure Rules
Exam-day strategy
Read each PBQ question slowly. The question is the largest weight on the exam and the PBQ scenarios often hinge on a single detail.
On log-analysis PBQs, look for the deviation from baseline first. The exam tests whether you can spot what is unusual.
Memorize the NIST SP 800-61 Rev. 2 phase names exactly. Containment-Eradication-Recovery and Post-Incident Activity are the names CySA+ tests against.
Watch for distractors that confuse CVSS (severity) with EPSS (exploitation likelihood).
Pace at roughly 1 minute 50 seconds per question. Flag and return on PBQs that need deep log review.
Additional resources
Explore Related Cybersecurity Resources
DecipherU is independent of CompTIA. CySA+ is a trademark of CompTIA. DecipherU is not endorsed by, sponsored by, or affiliated with any certifying body.