Prep
What this CySA+ study guide covers
This CySA+ study guide is for CompTIA Cybersecurity Analyst V4, exam code CS0-004, which CompTIA launched on June 23, 2026. CySA+ is CompTIA's analyst-level certification: it tests how you monitor, detect, investigate and report on threats, rather than the broad security basics covered by Security+.
Below you will find the exam facts, the CS0-003 vs CS0-004 decision, a 10-week plan mapped to the four official domains, a full CySA+ exam cost breakdown, and how we suggest using practice questions. Exam facts come from CompTIA's CySA+ pages; where we rely on another source, we say so.
| CS0-003 (V3) | CS0-004 (V4) | |
|---|---|---|
| Launched | June 6, 2023 | June 23, 2026 |
| Retires | English December 22, 2026; other languages March 23, 2027 | Not announced |
| Questions and time | Up to 85 in 165 minutes | Up to 85 in 165 minutes |
| Passing score | 750 (100-900) | 750 (100-900) |
| Domains | Security operations 33%, Vulnerability management 30%, Incident response 20%, Reporting 17% | Security Operations 34%, Vulnerability Management 26%, Incident Response 24%, Reporting 16% |
CySA+ CS0-004 exam facts
| Item | CS0-004 (V4) |
|---|---|
| Launched | June 23, 2026 |
| Questions | Maximum of 85 |
| Time | 165 minutes |
| Passing score | 750 on a scale of 100-900 |
| Languages | English, with French, Japanese, Spanish and Portuguese listed as coming soon |
| Prerequisites | None required. CompTIA recommends about four years in a SOC analyst or vulnerability analyst role |
| Validity | 3 years; renew with 60 CEUs and the CE fee, or another qualifying activity |
CompTIA's V4 page does not list question types. The V3 exam mixed multiple-choice and performance-based questions, and we recommend preparing for hands-on items on V4 as well: log and packet analysis, vulnerability scan output and incident response steps.
CS0-003 or CS0-004?
CySA+ V3 (CS0-003) launched in June 2023. CompTIA says it retires in English on December 22, 2026, and in Japanese, Portuguese and Spanish on March 23, 2027. Our recommendation:
- Starting now: study for CS0-004. There is not enough time left on the English CS0-003 to prepare properly from scratch.
- Nearly ready for CS0-003: book it soon if you can test before December 22, 2026. A pass on either version gives you the same CySA+ certification.
- Testing in Japanese, Portuguese or Spanish: CS0-003 stays available in those languages until March 23, 2027, while V4 translations are still listed as coming soon.
The weights also changed. Security operations went from 33% to 34%, vulnerability management from 30% to 26%, incident response from 20% to 24%, and reporting and communication from 17% to 16%. CompTIA's V4 objectives add a topic on the use of AI in security operations and more coverage of cloud and hybrid environments.
The 10-week CySA+ study plan
This plan assumes Security+ level knowledge and 8 to 10 hours a week. Each week combines reading, a lab session and practice questions on that week's domain.
| Week | Domain (weight) | Focus and lab |
|---|---|---|
| 1 | Security operations (34%) | Download the CS0-004 objectives. System and network architecture concepts relevant to monitoring: logging, identity, encryption, cloud and hybrid environments. |
| 2 | Security operations | Indicators of malicious activity on hosts, networks and applications. Lab: read Windows event logs and Linux auth logs; spot failed-login patterns. |
| 3 | Security operations | Tools and techniques: SIEM queries, packet capture, email header analysis, threat intelligence and threat hunting. Lab: analyse a sample capture in Wireshark. |
| 4 | Security operations | Process improvement, automation and the use of AI in security operations. Mixed practice set on domain 1. |
| 5 | Vulnerability management (26%) | Scanning methods and concepts, interpreting scan output, CVSS and prioritisation. Lab: run an open-source scanner against a deliberately vulnerable VM. |
| 6 | Vulnerability management | Mitigations for common web and infrastructure flaws, patching and compensating controls, cloud vulnerabilities, risk acceptance and exceptions. |
| 7 | Incident response and management (24%) | Attack frameworks, incident response phases, detection, containment, eradication and recovery, evidence handling. |
| 8 | Incident response and management | Preparation and post-incident activity, root cause analysis and lessons learned. Lab: walk a scenario from alert to closure and write the timeline. |
| 9 | Reporting and communication (16%) | Vulnerability and incident reports, metrics and KPIs, stakeholder communication, regulatory reporting. First full timed practice exam at the end of the week. |
| 10 | Review | Two timed practice exams, rework every miss against the objectives, repeat weak labs, then sit the exam. |
Our week-level topics follow the domain names and the topics CompTIA highlights on its V4 page. Always check the full objectives document, which lists every sub-objective.
CySA+ exam cost: the full breakdown
CompTIA's store loads prices dynamically, so we could not read the price on an official page. According to CompTIA partner Total Seminars, the US list price of a CySA+ voucher rose from US$425 to US$439 in mid-2026. Prices vary by country, and resellers often sell vouchers below list.
| Cost item | Amount | Notes |
|---|---|---|
| Exam voucher | US$439 | US list price, per Total Seminars. Check the CompTIA store for your country |
| Retake (if needed) | US$439 | A second full voucher, unless you bought a bundle with a retake |
| Study resource | Varies | One study guide or course; official objectives are free |
| Lab environment | Often free | Virtual machines and open-source tools on your own computer |
| Renewal via CEUs | US$150 per 3 years | CE fee plus 60 CEUs. Not charged if you renew through a single qualifying activity |
One cost saving: CompTIA treats CySA+ as a higher-level certification, so earning it also renews Security+ (and the lower certifications below it). If you hold both, you usually only need to maintain CySA+.
How hard is CySA+?
CySA+ is a clear step up from Security+. The questions are less about definitions and more about interpreting evidence: which log line matters, which vulnerability to fix first, what the next incident response step should be. The 165-minute exam is also long, so stamina matters.
CompTIA recommends about four years of analyst experience. You can pass with less, but you will need much more lab time to make up for it. CompTIA does not publish pass rates.
What to study with
CySA+ rewards practice with real data more than reading. We recommend this mix:
- The official CS0-004 exam objectives. Free from CompTIA, and the only complete list of what can be tested. Tick off each sub-objective as you cover it.
- One main study resource written for CS0-004. Many books and courses online still follow CS0-003. Check the exam code before you buy, and do not mix versions.
- A small home lab. Two or three virtual machines, a free SIEM or log platform, a packet analyser and an open-source vulnerability scanner cover most of the hands-on skills.
- Public sample data. Sample packet captures and log sets let you practise spotting malicious activity without building an attack lab.
- Practice questions after each domain, then full timed exams at the end.
Is CySA+ worth it?
CySA+ makes most sense if you already work in, or are moving into, a SOC, threat analysis or vulnerability management role. It proves you can do analyst work, not just name concepts. CompTIA also lists CySA+ among its certifications approved under the US Department of Defense's DoDM 8140.03 program, which matters for some government and contractor roles.
It is a weaker fit if you want penetration testing (PenTest+ targets that) or management and governance roles, where CISSP or CISM are more common; our CISM vs CISSP comparison covers those two. If you hold Security+ and plan to keep it, CySA+ also saves you separate Security+ renewals.
How to use practice questions
Practice questions are most useful when you treat each miss as a pointer back to the objectives. Answer a short set after every week of the plan, write one line on why each wrong answer was wrong, and switch to full timed exams in weeks 9 and 10.
We do not have a dedicated CySA+ practice test yet. If your Security+ knowledge is rusty, take our free Security+ practice test first: CySA+ assumes all of it. Our cybersecurity certification roadmap shows where CySA+ fits next to PenTest+, SecurityX and CISSP.