thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Using Army CA, Air Force, Space Force or SpouseWorks? Get the itemized quote your program asks for in one minute.
Get my military quote
Courses  /  CompTIA  /  CompTIA CySA+
Exam CS0-004CySA+ V4 CompTIA DoD 8140 / 8570College credit

CompTIA CySA+

The analyst certification: detect, analyze and respond to threats, and manage vulnerabilities, using the tools a real SOC runs on.

Five days, instructor-led In class or live online Exam voucher included Class Hub + 90 days Military funding accepted DoD 8570: IAT II, CSSP Analyst, CSSP Infrastructure Support +2 Up to 3 college credits

Course overview

Blue teamDefensive securityThreat detection, vulnerability management and incident response
4 domainsOne examOperations, vulnerabilities, incident response, reporting
DoD 8140ApprovedRecognised for DoD cyber defense work roles

thinQtank® Learning is offering an industry-unique five-day training camp during which students can receive the CompTIA CySA+ certification. As with our CompTIA Training Experiences, exams are delivered in the classroom.

Learn how to analyze, monitor, and protect critical infrastructures using threat-detection and threat-analysis tools. Acquire the practical tools and tactics to effectively manage cybersecurity risks, identify common threats, evaluate an organization's security, collect and analyze cybersecurity intelligence, and handle incidents as they occur. This comprehensive approach to security is specifically designed for those on the front lines of defense. This course is designed to assist students in preparing for the CompTIA CySA+ - Cybersecurity Analyst+ (CS0-004, V4) certification exam. It includes an exam voucher, study guide, and practice exams.

CompTIA's CySA+ is a globally recognized, vendor-neutral certification that validates intermediate-level knowledge and skills required by information security analyst job roles. It demonstrates your ability to proactively defend an organization using secure monitoring, threat identification, incident response, and teamwork. The CompTIA CySA+ CS0-004 certification exam ensures you have the knowledge and skills to:

After this course you will be able to:

  • Detect and analyze indicators of malicious activity
  • Understand threat hunting and threat intelligence concepts
  • Use appropriate tools and methods to manage, prioritize and respond to attacks and vulnerabilities
  • Perform incident response processes
  • Understand reporting and communication concepts related to vulnerability management and incident response activities

Your certification path

Where this course sits: what to have first, and where it leads.

Course objectives

What you will be able to do by the end of the class.

Apply security operations concepts — architecture, logging, identity and encryption — the way an analyst uses them
Detect and analyze indicators of malicious activity across networks, hosts and applications
Use threat intelligence and threat hunting to find what the alerts miss
Monitor and automate with SIEM, SOAR, EDR and scripting
Run vulnerability scans, then analyze, prioritize and drive remediation of the findings
Respond to incidents using attack frameworks and the incident response life cycle
Collect and preserve evidence and perform forensic analysis
Report vulnerability and incident findings with metrics and briefings stakeholders act on

Who it is for

Who gets the most from this class, and what to know before you start.

Who should attend

  • IT Security Analyst
  • Security Operations Center (SOC) Analyst
  • Vulnerability Analyst
  • Cybersecurity Specialist
  • Threat Intelligence Analyst
  • Security Engineer

Prerequisites

  • At least two years of experience in computer network security technology
  • Recognize information security vulnerabilities and threats
  • Operational skills with some of the standard operating systems
  • Knowledge of networking protocols including, but not limited to, TCP, IP, UDP, DNS, HTTP, ARP, ICMP, and DHCP

Course outline

6 modules. Open any one to see what it covers.

01Security operations
  • System and network architecture for analysts
  • Threat intelligence and threat hunting
  • Indicators of malicious activity
02Tools and techniques
  • SIEM, SOAR and log analysis
  • Packet and endpoint analysis
  • Automation and scripting for analysts
03Vulnerability management
  • Scanning methods and tools
  • Analyzing and prioritizing findings
  • Controls and remediation
04Application and cloud vulnerabilities
  • Web application attacks
  • Cloud and container risk
  • Secure coding and validation
05Incident response
  • Attack frameworks: MITRE ATT&CK, kill chain
  • Detection, containment and eradication
  • Forensics and evidence handling
06Reporting and communication
  • Vulnerability and incident reports
  • Metrics and KPIs
  • Communicating with stakeholders

The full lesson-by-lesson outline is in the course datasheet (PDF).

Course features

How the class is taught, and why it works.

Live, instructor-ledEvery session is taught live by a certified instructor, in the classroom and online at the same time.
Hands-on labs20% of class time is hands-on lab work, not slides.
Exam preparation built inPractice questions and focused review aligned to exam CS0-004, with the exam delivered in the classroom.
Class Hub for 90 daysRecordings, materials and practice stay open for the class plus 90 days after it ends.
Attend your waySterling, VA, Atlanta, GA, Burbank, CA, or live online from anywhere.
Funding friendlyMilitary flat rate, thinQflex monthly payments, or a formal quote for your employer.

What you get

Everything below is included in the course price.

Class Hub access for the length of the class plus 90 days
thinQtank® Learning Accelerated Custom Exam Study Guide for the CySA+ Exam
Exam delivery in classroom with 98% success
Custom and focused exam preparation software and materials
Course specific thinQtank® Learning publications to promote a fun and exciting learning
Membership to the thinQtank® Learning University Online
WE DO NOT "TEACH THE TEST" - Students will receive valuable examples and discussion
Receive all reading material and study guides when you register
All courses taught by expert security certified instructors
CompTIA-approved CySA+ training program
After-course instructor coaching benefits
Complete KALI Linux Build with VMWare
Custom interactive study materials that assure success on the exam - FIRST ATTEMPT!

Format: Five days of instructor-led training · 80% Lecture and 20% Demonstration Labs · Instructor-Led Training, Immersive Live-Online Training, On-Site and Custom Delivery

Study plan

How the five days run, plus what to do before and after class.

Before class
  • Check the prerequisites above and fill any gaps
  • We send joining details and course materials before day one
Day 1
  • Security operations
  • Tools and techniques
Day 2
  • Vulnerability management
  • Application and cloud vulnerabilities
Day 3
  • Incident response
  • Reporting and communication
Day 5
  • Final review and exam
After class
  • Class Hub stays open 90 days: recordings, labs and practice
  • Missed a passing score? Review your weak domains and rebook

The order of topics can shift with the class; your instructor confirms the schedule on day one.

The certification exam

CompTIA CySA+ (V4) · exam CS0-004

Exam codeCS0-004
QuestionsUp to 85
Time165 minutes
Passing score750 / 900

Exam domains and weighting

1. Security Operations
34%
2. Vulnerability Management
26%
3. Incident Response and Management
24%
4. Reporting and Communication
16%
Format
Multiple choice and performance-based
Voucher
Exam voucher included
Validity
Valid for three years, renewed through CompTIA continuing education

DoD 8140 and college credit

What this certification counts for with the Department of Defense, and toward a degree.

DoD 8140 / 8570 CySA+ qualifies for 5 of the 14 DoD workforce categories, and also covers IAT Level I because higher IAT and IAM levels satisfy lower ones.
Information Assurance Technical, Level II IAT Level II
2–5 years typicalGS-9 to GS-11
System administrator · Network administrator · Junior security analyst · ISSO on a small system
Typically performs (DCWF): 451 System Administrator; 441 Network Operations Specialist; 521 Cyber Defense Infrastructure Support Specialist
Cybersecurity Service Provider Analyst CSSP Analyst
2–5 years typicalGS-11 to GS-12
SOC analyst · Cyber defense analyst · Threat hunter · Watch floor analyst
Typically performs (DCWF): 511 Cyber Defense Analyst
Cybersecurity Service Provider Infrastructure Support CSSP Infrastructure Support
3–6 years typicalGS-11 to GS-12
Sensor / tool administrator · IDS-IPS engineer · SIEM engineer · Defensive infrastructure support
Typically performs (DCWF): 521 Cyber Defense Infrastructure Support Specialist
Cybersecurity Service Provider Incident Responder CSSP Incident Responder
3–7 years typicalGS-12 to GS-13
Incident responder · DFIR analyst · CIRT member · Digital forensics examiner
Typically performs (DCWF): 531 Cyber Defense Incident Responder; 212 Cyber Defense Forensics Analyst
Cybersecurity Service Provider Auditor CSSP Auditor
4–8 years typicalGS-12 to GS-13
Security control assessor · Compliance auditor · Red team support · Vulnerability assessment analyst
Typically performs (DCWF): 612 Security Control Assessor; 541 Vulnerability Assessment Analyst

DoD 8570 was replaced by DoD 8140 work roles (contractors since February 2026), but job postings still use these categories. DoD publishes no crosswalk between the two; the work roles shown are what this population typically performs, not an official mapping. Experience figures are typical, not requirements.

College credit Pass the exam and these universities will count it toward a degree. This is what each school publishes about its own transfer policy; the registrar makes the final call.
3credits UMGC
Built into the degree WGU removes a required course
Accepted Purdue Global amount not published
Accepted AMU / APUS amount not published

Most schools only count IT certifications earned in the last three to five years (some require them to be current), and several will not award transfer credit once you have enrolled. Get your evaluation done first.

Where it can take you

Roles this certification is commonly asked for.

SOC AnalystMonitor, triage and investigate security alerts.
Security AnalystAnalyze threats and recommend defenses.
Threat Intelligence AnalystTrack adversaries and turn intelligence into detections.
Vulnerability AnalystScan, prioritize and drive remediation.
Incident ResponderContain and investigate breaches.
Security EngineerBuild and tune detection and response tooling.

Upcoming dates

Every class runs in the classroom and live online at the same time. Pick the dates; choose how you attend when you register.

DatesLocationFormat
Nov 16 – 20, 2026 Sterling, VA Classroom + live online Reserve
Dec 7 – 11, 2026 Burbank, CA Classroom + live online Reserve
Dec 7 – 11, 2026 Atlanta, GA Classroom + live online Reserve
Jan 18 – 22, 2027 Sterling, VA Classroom + live online Reserve
Jan 25 – 29, 2027 Atlanta, GA Classroom + live online Reserve
Feb 8 – 12, 2027 Burbank, CA Classroom + live online Reserve
Mar 22 – 26, 2027 Atlanta, GA Classroom + live online Reserve
Mar 22 – 26, 2027 Sterling, VA Classroom + live online Reserve
Apr 12 – 16, 2027 Burbank, CA Classroom + live online Reserve
May 17 – 21, 2027 Atlanta, GA Classroom + live online Reserve
May 17 – 21, 2027 Sterling, VA Classroom + live online Reserve
Jun 14 – 18, 2027 Burbank, CA Classroom + live online Reserve

9 more dates through December 2027. Ask about a later date.

Paying for it

The price above is our standard rate. These options can bring it down or spread it out.

Military & veterans
$1,500

Flat rate per class when you use Air Force COOL, Army Credentialing Assistance, MyCAA or VET TEC 2.0. Your program confirms eligibility.

Funding details
thinQflex™
Name your price

Paying yourself? Tell us what you can pay and over how many months, up to twelve. We say yes, or come back with terms.

Make an offer
Employer or agency
Formal quote

A formal quote with the course and exam voucher as separate lines, valid 30 days. Group and government pricing available.

Request a quote

How to enroll

Four steps from here to certified.

  1. Pick your datesChoose a class from the dates above, in a classroom or live online.
  2. Reserve or get a quoteReserve your seat, ask for a quote for your employer, or make a thinQflex offer.
  3. Get readyWe confirm your seat and send joining details and materials before day one.
  4. Attend and certifyTake the class, then sit exam CS0-004, with Class Hub open for 90 days after.

Frequently asked questions

Do I need Security+ first?
CompTIA recommends Network+ and Security+ knowledge and about four years of hands-on experience. Security+ is the usual step before CySA+.
Does CySA+ renew Security+?
Yes. Earning CySA+ automatically renews a lower-level CompTIA certification such as Security+.
What does it cost?
The standard price is $2,950, including the exam voucher. Military students using AF COOL, Army CA, MyCAA or VET TEC 2.0 pay $1,500, and thinQflex lets you name your own price and monthly payment.
How long is the class?
Five days of live, instructor-led training, about 20% of it hands-on labs.
Can I attend live online?
Yes. Every class runs live online at the same time as the classroom, with the same instructor and labs.
How long do I keep access to the materials?
Your Class Hub stays open for the length of the class plus 90 days.
Is the exam included?
Yes, the exam voucher is included in the course price.
Can I use military funding?
Yes. With Air Force COOL, Army CA, MyCAA or VET TEC 2.0 you pay a flat $1,500 per class.
Can my employer pay?
Yes. Request a quote and we will send a formal one, valid for 30 days.
What if I cannot pay all at once?
Use thinQflex to name your price and spread payments over up to twelve months.
Where are the classrooms?
Sterling, Virginia; Atlanta, Georgia; and Burbank, California. Every class also runs live online, so you can join from anywhere.
What do I need to attend online?
A computer with a reliable internet connection, a headset or speakers, and a microphone. A webcam is recommended.
Will I get a certificate of completion?
Yes. You receive a thinQtank Learning certificate of completion when you finish the class.
Which course should I take next?
Most students go on to CompTIA Security+, CompTIA PenTest+, CompTIA SecurityX. Tell us your goal and we will map the path with you.
Do you run private classes for teams?
Yes. We deliver private classes on-site or online for teams and agencies, on your dates. Ask for a quote.
Can you help me choose the right course?
Yes. Call 855-868-4467 or email sasmith@thinqtanklearning.com and we will recommend the right starting point.

Ready to earn your CySA+?

Next class Dec 7 – 11, 2026 · Atlanta, GA and live online.