CompTIA CySA+ exam guide

Exam CS0-004

CompTIA CySA+ validates blue-team analyst skills: detecting and analyzing threats, managing vulnerabilities, responding to incidents and reporting to stakeholders. The V4 exam (CS0-004) launched June 23, 2026 and puts the most weight on security operations. It is a common next step after Security+ for SOC and threat analyst roles and is approved under DoD 8140.

QuestionsUp to 85

Time limit165 minutes

Passing score750 (100-900 scale)

Exam fee$439 USD

Valid for3 years

DeliveryPearson VUE test center or online proctored (OnVUE)

Format: Multiple choice and performance-based. Fee note: 2026 US retail price.

Who it's for

SOC analysts, incident responders and vulnerability analysts with about four years of hands-on security experience who hold Security+ or equivalent knowledge.

What the exam covers

Security Operations34%

Vulnerability Management26%

Incident Response and Management24%

Reporting and Communication16%

Eligibility & prerequisites

Required: None

Recommended: About 4 years of hands-on experience as an incident response analyst, SOC analyst or vulnerability analyst; Network+ and Security+ or equivalent knowledge.

Keeping it active

Valid 3 years. Renew through CompTIA Continuing Education: earn 60 CEUs in the 3-year cycle and pay the $150 CE fee, or pass a newer version or a higher-level CompTIA exam that renews it automatically, or complete the matching CertMaster CE course.

Skills & careers

Skills it validates

Analyzing logs, SIEM alerts and network traffic
Threat hunting and threat intelligence use
Running and interpreting vulnerability scans
Prioritizing and remediating vulnerabilities
Executing the incident response life cycle
Using automation and AI-assisted tooling in the SOC
Writing incident and vulnerability reports for stakeholders

Job roles

SOC Analyst (Tier 2)Cybersecurity AnalystThreat Intelligence AnalystIncident ResponderVulnerability AnalystThreat Hunter

DoD 8140

Recognized in the DoD 8140 qualification matrix for cyber defense analyst, incident responder and related cybersecurity work roles. Open the DoD Workforce Navigator

Where it fits in your path

Take before

CompTIA Security+CompTIA Network+

Go next

CompTIA PenTest+ CompTIA SecurityX (formerly CASP+) GIAC Certified Incident Handler (GCIH)Microsoft Security Operations Analyst

Planning a degree too? See how this cert earns college credit in the College Credit Navigator.

Build my study plan

Week 1: Review the CS0-004 objectives and confirm you use V4 materials; take a diagnostic test.
Week 2-3: Security operations (34%): log and packet analysis, SIEM queries, EDR, email and web indicators, automation.
Week 4-5: Vulnerability management (26%): scanner configuration, CVSS, false positives, remediation prioritization and controls.
Week 6: Incident response and management: frameworks, containment, evidence handling, post-incident activity.
Week 7: Reporting and communication: metrics, stakeholder reporting and compliance; practice reading scan reports.
Week 8: Two full timed practice exams with performance-based items; use the 165 minutes to pace yourself.

Make it yours: pick your exam date and weekly hours. We'll split your time by domain weight and give you a printable plan.

Exam date Hours per week

Exam-day tips

Security operations is 34% of the exam; be fluent reading raw log lines, packet captures and command output.
Expect performance-based items that ask you to interpret vulnerability scan output and pick remediation priority.
Know CVSS base metrics and how environmental context changes priority.
You have 165 minutes for up to 85 questions; you can afford to work simulations carefully.
Learn incident response phase order and which actions belong in containment vs eradication vs recovery.

Key terms for this exam

All 356 terms Study with thinQcards™

Commonly confused on this exam

Vulnerability vs Threat vs Risk Credential Stuffing vs Password Spraying Zero-Day Vulnerability vs Known (N-Day) Vulnerability Hacktivist vs Nation-State Actor vs Insider Threat SAST vs DAST vs IAST Allow List vs Deny List Intrusion Detection System vs Intrusion Prevention System SIEM vs SOAR EDR vs XDR vs MDR Vulnerability Scan vs Penetration Test Red Team vs Blue Team vs Purple Team Security Event vs Security Incident vs Data Breach

Frequently asked questions

How much does CySA+ cost?

The CS0-004 voucher is $439 USD at CompTIA's 2026 US retail price.

What changed in CS0-004?

V4 launched June 23, 2026 with four domains led by Security Operations (34%), a shorter maximum of 85 questions and a 165-minute time limit.

Does CySA+ renew Security+?

Yes. Earning CySA+ renews lower-level CompTIA certifications you hold, such as Security+ and Network+.

CySA+ vs PenTest+: which first?

Choose CySA+ for blue-team, SOC and incident response roles; choose PenTest+ for offensive testing roles.

How do I renew CySA+?

Earn 60 CEUs within 3 years and pay the $150 CE fee, or pass a higher-level CompTIA exam such as SecurityX.

Official page: www.comptia.org. Reviewed November 2026. Vendors change fees and objectives, so confirm with the vendor before you book. Spot something out of date? Tell us.

1. Map it thinQguide™ · 409 cert guides 2. Learn it thinQterms™ · 7,491 terms 3. Untangle it 180 look-alike comparisons 4. Prove it thinQready™ · free readiness check

Find your exam