CS0-004
CS0-004: CompTIA CySA+
What is CompTIA CySA+ CS0-004? Up to 85 questions in 165 minutes, passing score 750, four domains, a four-week study plan and free sample questions.
- Duration
- 165 min
- Passing score
- 750 / 900
- Level
- Intermediate
- Questions
- Max 85
CS0-004 is the exam code of CompTIA CySA+ version 4 (V4), CompTIA’s intermediate certification for security analysts. It launched on June 23, 2026 and replaces CS0-003. The exam has a maximum of 85 questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900.
CompTIA describes the target candidate as someone with about four years in a security operations or vulnerability analyst role. The exam checks that you can read the evidence, such as logs, scan output and alerts, decide what it means and say what to do next, and then report it clearly.
The visible change from CS0-003 is a new objective on the use of artificial intelligence in security operations, covering use cases, risks and governance.
What the exam covers
| Domain | Weight |
|---|---|
| 1.0 Security Operations | 34% |
| 2.0 Vulnerability Management | 26% |
| 3.0 Incident Response and Management | 24% |
| 4.0 Reporting and Communication | 16% |
Security Operations is the largest domain: architecture and logging, spotting malicious activity, tools such as SIEM and EDR, threat intelligence and hunting, automation and the new AI objective. Vulnerability Management and Incident Response together make up half of the exam, and the smallest domain, Reporting and Communication, is the easiest to under-prepare.
Where to start
Read the exam format guide for the mechanics, then how CS0-004 differs from CS0-003 if you are choosing which version to take. The study plan spreads four weeks across the four domains, and the free sample questions show the scenario style.
CS0-004 guides
- CS0-004 exam format: questions, score, timingCS0-004 CySA+ format: up to 85 questions in 165 minutes, passing score 750 on 100-900, four domain weights, languages and what CompTIA does not publish.
- CS0-004 vs CS0-003: which CySA+ to takeCS0-004 vs CS0-003: CySA+ V4 launch and V3 retirement dates, the four domains, the new AI objective and which version to take while both are open.
- CS0-004 study plan: pass in 4 weeksA four-week CS0-004 CySA+ study plan: operations, vulnerabilities, incident response, then reporting, with a hands-on task and review each week.
- CS0-004 sample questions: 5 worked examplesFive worked CS0-004 CySA+ sample questions on log analysis, vulnerability priority, containment, AI risk and reporting, with explained answers.
- CS0-004 security operations explainedThe CS0-004 CySA+ Security Operations domain explained: architecture and logging, indicators, SIEM and EDR, threat hunting, automation and AI in the SOC.
- CS0-004 vulnerability management explainedThe CS0-004 CySA+ Vulnerability Management domain explained: scan methods, reading scanner output, risk-based prioritisation, controls and compliance.
- CS0-004 incident response explainedCS0-004 CySA+ domain 3 explained: ATT&CK and Kill Chain, incident response phases, triage, evidence handling, escalation and root cause, with questions.
- CS0-004 reporting and communicationCS0-004 CySA+ domain 4 explained: vulnerability reports, dashboards, escalation, incident documentation, post-incident reviews and metrics like MTTD.
- Free CS0-004 practice questions: 20 with answers20 free CS0-004 CySA+ practice questions across four domains, weighted 34/26/24/16 like the objectives, with explained answers.
- CS0-004 study resources: free official sourcesFree sources to study for CS0-004: CompTIA's exam page, NIST SP 800-61, MITRE ATT&CK, CVSS, EPSS and CISA KEV, plus labs and how to avoid braindumps.
- CS0-004 cheat sheet: CySA+ quick referenceOne-page CS0-004 CySA+ reference: exam facts, domain weights, incident response order, prioritisation inputs, key frameworks and common exam traps.
- Is CS0-004 hard? CySA+ difficulty explainedHow hard is the CS0-004 CySA+ exam? What makes it demanding, who finds it easier, common reasons for failing and how to prepare for the analyst level.
- Is CS0-004 CySA+ worth it? Who should take itIs CompTIA CySA+ CS0-004 worth taking? Who benefits, who should pick Security+ or another path first, and what the exam does and does not prove.
- CS0-004 career: jobs CompTIA ties to CySA+Job roles CompTIA itself names for CySA+, how the four CS0-004 domains map to daily work, and which CompTIA exams sit before and after it.
- CS0-004 renewal, validity and retake rulesCySA+ is valid three years and renews with 60 CEUs and a $150 fee per cycle. Retake waits, full fees and what CompTIA says about passed exam codes.
- CS0-004 study scenarios: three profilesSplit CS0-004 CySA+ study hours for a SOC analyst, a Security+ holder and a sysadmin using the 34/26/24/16 domain weights, with example hour totals.
- CS0-004 prerequisites: what you need firstCySA+ CS0-004 recommends about four years in a SOC or vulnerability analyst role. The knowledge you need before you start and how to check your level.