CS0-004 exam format: questions, score, timing
CS0-004 (CompTIA CySA+ V4) has a maximum of 85 questions, lasts 165 minutes and requires 750 on a scale of 100 to 900 to pass. It launched on June 23, 2026. CompTIA’s V4 certification page does not list a price, so none is stated here.
| Exam title | CompTIA CySA+ CS0-004 (V4) |
| Level | Intermediate; recommended experience is about four years as a SOC analyst or vulnerability analyst |
| Number of questions | Maximum of 85 |
| Question types | Multiple-choice and performance-based (per CompTIA’s CySA+ blog; not listed on the V4 page) |
| Duration | 165 minutes |
| Passing score | 750 on a scale of 100-900 |
| Launch | June 23, 2026 |
| Languages | English; French, Japanese, Spanish and Portuguese are listed as coming |
| Price | Not listed on the V4 page; check CompTIA’s store or the test provider when booking |
| Renewal | Three-year cycle through continuing education; see renewal and retakes |
CompTIA’s CySA+ blog says the exam combines multiple-choice questions with performance-based questions. It does not publish the split, so prepare for scenario items where evidence has to be read, such as a log extract, a scan result or a short alert timeline.
The four domains
| Domain | Weight | Approx. share of 85 questions |
|---|---|---|
| 1.0 Security Operations | 34% | about 29 |
| 2.0 Vulnerability Management | 26% | about 22 |
| 3.0 Incident Response and Management | 24% | about 20 |
| 4.0 Reporting and Communication | 16% | about 14 |
CompTIA publishes single percentages rather than ranges. The question counts above are simple arithmetic on a full-length exam; the real distribution can differ, and the exam may contain fewer than 85 questions.
What the weights mean for revision
Security Operations is the largest domain by a clear margin. It spans logging and architecture, indicators of malicious activity, tools such as SIEM and EDR, threat intelligence and hunting, automation, and the new objective on AI in security operations. Study it first and longest. Detail is on the security operations page.
Vulnerability Management and Incident Response together carry half the exam. The first rewards judgement about priority: a high score on a system that is isolated and non-critical may rank below a lower score that is actively exploited and exposed. The second rewards knowing the order of the response process. See vulnerability management and CVSS and the incident response lifecycle.
Reporting and Communication is the smallest domain and the one candidates tend to skip. It is vocabulary-heavy and quick to learn: who receives which report, what a post-incident review produces and which metrics (time to detect, time to respond, remediation effectiveness) show whether the process works.
The passing score is scaled
750 on a 100-900 scale is not the same as 83% correct. CompTIA scales scores and does not publish the conversion, so a percentage target is only an estimate. A consistent 80-85% on realistic, scenario-style practice material is a reasonable readiness signal, not a guarantee.
Timing
165 minutes for at most 85 questions is roughly two minutes per question, which is generous for single-answer items and tight for long scenarios with several exhibits. A workable approach: answer what is clear, flag anything that needs a long read, and return with the remaining time. Test-day logistics are on the exam day guide.
Version and dates
CS0-003 is still available for now. CompTIA’s CySA+ page lists the English learning products for V3 as retiring on November 22, 2026, the English exam on December 22, 2026 and translations on March 23, 2027. The comparison with CS0-003 explains which version to take. Dates can change, so check CompTIA’s site and the exam changes page before booking. For cost structure in general, see certification costs.