Intermediate CompTIA · Exam CS0-004

CompTIA CySA+ (CS0-004) Study Guide

CompTIA CySA+ is the analyst-tier security certification, and the current version is CS0-004, which launched on 23 June 2026. The exam is up to 85 questions in 165 minutes, with performance-based questions that put you in front of logs, alerts and vulnerability output rather than asking for definitions. It covers security operations, vulnerability management, incident response and reporting — the work of a SOC analyst rather than the concepts of a security generalist.

Overview

Level

Intermediate

Vendor

CompTIA

Audience

Security and SOC analysts, vulnerability analysts, and Security+ holders ready to move from knowing what a control does to working a queue of alerts. CompTIA pitches it at around four years in an analyst role — that is the level the questions assume, not a rule. It also carries weight in government and defence hiring, where it maps to DoD 8140 workforce roles.

Why get CySA+

CySA+ is the natural step up from Security+: where Security+ proves you understand security concepts, CySA+ proves you can do the analyst work—reading alerts, triaging vulnerabilities, and running an incident-response process. It is performance-based and built around the real workflow of a SOC, which is exactly what employers hiring analysts want to see. It also carries DoD 8140 approval for several cybersecurity workforce roles, giving it weight in government and defense hiring. For anyone targeting a SOC analyst, threat-detection, or vulnerability-management role, CySA+ is a strong, recognized signal of job-ready skill.

Salary expectations

Typical salary range

$80,000 – $120,000

CySA+ targets the analyst tier of cybersecurity. Cybersecurity and SOC analysts with CySA+ commonly earn $85K–$115K, with experienced analysts and senior SOC roles reaching $120K–$145K. Government and defense roles (where CySA+ is DoD-8140 approved) add clearance premiums and strong benefits on top of base salary.

When to get CySA+

Take CySA+ after Security+, once you have spent real time with logs, a SIEM, or at least a home lab that generates alerts worth triaging. Timing matters this year: CS0-004 launched in June 2026, and the older CS0-003 exam retires on 22 December 2026 in English, with its learning products withdrawn a month earlier on 22 November 2026 and translated exams following on 23 March 2027. If you are starting now, start on CS0-004. If you are already deep into CS0-003 material you can still sit that version until December — both award the same certification.

Exam details

Exam Quick Reference

Exam Code
CS0-004
Vendor
CompTIA
Level
Intermediate
Duration
165 minutes
Format
Up to 85 questions: multiple choice and performance-based. Passing score: 750 (on a scale of 100–900).
Questions
Up to 85 questions
Official exam page Verify current pricing

Renewal: Valid for 3 years. Renew through CompTIA's Continuing Education (CE) program by earning CEUs, or by passing a higher-level CompTIA exam. CySA+ also renews lower CompTIA certs like Security+.

Facts on this page last verified September 24, 2026 against official CompTIA sources.

Skills covered

Security Operations (33%)

  • Continuous security monitoring and log analysis
  • Detecting malicious activity across network, host, and identity data
  • Threat intelligence and threat hunting concepts
  • Tuning detection rules and reducing false positives
  • Common attack techniques (mapped to MITRE ATT&CK)

Vulnerability Management (30%)

  • Running and interpreting vulnerability scans
  • Prioritizing vulnerabilities with CVSS and asset context
  • Validating findings and managing remediation
  • Common vulnerabilities in networks, hosts, web apps, and cloud
  • Attack-surface and exposure management

Incident Response & Management (20%)

  • The incident response lifecycle (NIST SP 800-61)
  • Detection, containment, eradication, and recovery
  • Evidence handling and basic forensics concepts
  • Indicators of compromise and post-incident analysis
  • Playbooks, runbooks, and escalation

Reporting & Communication (17%)

  • Communicating vulnerability and incident findings to stakeholders
  • Writing clear, actionable reports
  • Metrics, KPIs, and risk communication
  • Compliance and audit reporting basics
  • Collaboration across security and business teams

Step-by-step study path

This sequence reflects what consistently works. Follow it in order—don't skip ahead.

  1. 1

    Download the CS0-004 exam objectives

    Get the official CySA+ CS0-004 objectives from CompTIA. The four domains map to a real analyst's workflow—use them to structure your study and spot weak areas early.

  2. 2

    Make sure your Security+ foundation is solid

    CySA+ assumes Security+ level knowledge. If any Security+ topics are shaky (cryptography, network security, identity), shore them up first—CySA+ builds directly on them.

  3. 3

    Work through a primary video course

    Choose one comprehensive CS0-004 course and complete it end to end. Jason Dion's CySA+ course on Udemy covers all four domains with scenario practice. See the paid resources section.

  4. 4

    Read the official study guide

    The Sybex CySA+ Study Guide (CS0-004) by Chapple & Seidl is the standard written reference. Use it to deepen the vulnerability-management and incident-response domains, which reward detail.

  5. 5

    Get hands-on with real tools

    Practice the analyst workflow: run a vulnerability scanner, read SIEM alerts, analyze logs and packet captures. Free labs on TryHackMe (SOC Level 1/2 paths) and Blue Team exercises make the scenario questions intuitive.

  6. 6

    Drill performance-based questions

    CySA+ leans heavily on PBQs that ask you to analyze output and make a decision. Practice interpreting scan results, logs, and alerts under time pressure—this is where the exam is won or lost.

  7. 7

    Take timed practice exams

    Use full-length CS0-004 practice exams. Aim to score consistently above 85% before booking. Review every miss until you understand the analyst reasoning, not just the answer.

  8. 8

    Schedule and sit the exam

    Register through Pearson VUE for the 165-minute exam (test center or online proctored). Book about two weeks out to set a deadline. Pace yourself—PBQs take longer than multiple-choice.

Ready for a structured course?

A top-rated course covers every CySA+ exam domain in order. See the paid resources section below for options and pricing.

View course options →

Free resources

Official Documentation CompTIA CySA+ CS0-004 Exam Objectives (Official)

The official CS0-004 objectives across all four domains. Your study roadmap—start here.
Hands-on Labs TryHackMe – SOC Level 1 & 2 Paths

Browser-based blue-team labs on SIEM, log analysis, threat detection, and incident response. The closest free match to real CySA+ analyst tasks.
Reference MITRE ATT&CK Framework

The free knowledge base of adversary tactics and techniques that underpins modern detection. Worth knowing for the security-operations domain.
Video Course MyDFIR – SOC Analyst Series (YouTube)

Free, practical content on detection, log analysis, and incident response—useful for building the analyst intuition the exam tests.
Community r/CompTIA on Reddit

Active community with CySA+ study advice and recent pass reports. Useful for understanding the current exam experience.

Vouchers & exam cost

Buy CySA+ Exam Voucher – CompTIA Store

The CS0-004 exam runs about $370–$425 USD. CompTIA sometimes bundles vouchers with retake insurance—verify current pricing on the official store before purchasing.

Frequently asked questions

Should I take CS0-003 or CS0-004?

CS0-004 launched on 23 June 2026 and is the current version — start there if you are starting now. CS0-003 is still bookable until its English retirement on 22 December 2026 (learning products are withdrawn on 22 November 2026, translated exams retire on 23 March 2027), so finish on CS0-003 if you are already deep into that material. Both award the same CySA+ certification, and a pass on either is valid for three years.

Is CySA+ harder than Security+?

Yes. CySA+ is more advanced and more hands-on. Security+ tests whether you understand security concepts; CySA+ tests whether you can analyze real data—logs, scans, alerts—and make analyst decisions. Expect more performance-based questions.

Should I take Security+ before CySA+?

Strongly recommended. CySA+ assumes Security+ level knowledge and builds directly on it. Most people take Security+ first, then CySA+ once they have some hands-on security exposure.

Is CySA+ DoD approved?

Yes. CySA+ is approved under DoD Directive 8140 for several cybersecurity workforce roles, which gives it real weight in government and defense-contractor hiring.

How long does it take to study for CySA+?

Most candidates spend 3 to 5 months. Those already working in or near a SOC may be ready sooner. Hands-on practice with SIEM, scanning, and log analysis matters as much as video completion.

Is CySA+ worth it?

For analyst-track roles, yes. It maps directly to SOC and security-analyst job tasks, carries DoD approval, and bridges the gap between Security+ and senior credentials. It's most valuable paired with hands-on experience.

What comes after CySA+?

Depending on direction: CompTIA SecurityX (formerly CASP+) for advanced practitioners, PenTest+ for offensive security, or vendor/role certs like CISSP as you gain experience. Many analysts also pursue cloud security next.

Does CySA+ expire?

Yes. CySA+ is valid for three years. Renew through CompTIA's Continuing Education program by earning CEUs or passing a higher-level CompTIA exam. Renewing CySA+ also renews lower certs like Security+.

Jobs where CySA+ shows up

7 roles in our Career Navigator list CySA+ as worth having. Each page covers what the job involves day to day, its honest downside, and the typical pay.

Not sure which of these fits you? Take the free Navigator assessment →

More CompTIA certifications

The full CompTIA roadmap →

Ready to study?

Start with the free resources above, then add a top-rated course and practice exams when you're ready to test yourself.

Udemy View recommended course
Explore more CompTIA certs