Certification guide
CompTIA CySA+ is the vendor-neutral certification for the people who sit on the defensive side of the wire: SOC analysts, threat hunters, vulnerability analysts, and incident responders. Where Security+ proves you understand security concepts, CySA+ proves you can apply them under operational conditions, reading logs, triaging alerts, prioritizing vulnerabilities by real risk, running an incident through its lifecycle, and reporting all of it to stakeholders who need to act. It sits in the middle of CompTIA’s cybersecurity pathway, above Security+ and below the expert-level SecurityX, and it is approved under DoD Directive 8140 for a long list of cyber defense work roles.
The current exam version is CS0-004 (V4), which went live on June 23, 2026. The format carries over unchanged from V3 (up to 85 multiple-choice and performance-based questions, a 165-minute window, and a passing score of 750 on a 100-900 scale) but the objectives were rebalanced and modernized. V4 adds explicit coverage of AI in security operations: using AI tools for log correlation and reporting, governing their use, and defending against AI-specific risks like prompt injection, hallucinated findings, sensitive-data exposure, and training-data poisoning. It also formalizes the control taxonomy (physical, technical, and administrative types; deterrent through compensating functions) and leans harder into cloud, hybrid, and critical-infrastructure scenarios. The older CS0-003 exam remains available in English through December 22, 2026, but new candidates should prepare for V4, these practice exams are written to the V4 blueprint.
CompTIA recommends about four years of hands-on experience in a SOC analyst or vulnerability analyst role, with Network+ and Security+ (or equivalent knowledge) as the assumed foundation. There is no enforced prerequisite, but the exam is scenario-driven and punishes pure memorization: questions describe realistic telemetry, competing priorities, and messy operational constraints, then ask what a practitioner should do first, next, or instead.
Security Operations
Domain 1 · 34%The heaviest domain and the analyst’s daily bread: log and telemetry analysis across network, endpoint, identity, and email; detecting beaconing, tunneling, lateral movement, and living-off-the-land tradecraft; threat intelligence and hunting; SIEM tuning and alert triage; SOAR automation; and the new V4 material on using AI in operations while defending against prompt injection, hallucination, and poisoning.
Vulnerability Management
Domain 2 · 26%Running the full program: scan types and scheduling (credentialed, agent-based, passive, and critical-infrastructure scanning), validating findings, CVSS and EPSS interpretation, KEV-driven prioritization, remediation versus compensating controls, exceptions and governance, secure-coding flaws like injection and overflows, cloud misconfigurations, and the V4 control-type and control-function taxonomy.
Incident Response and Management
Domain 3 · 24%The lifecycle from preparation through lessons learned, expanded in V4: playbooks and tabletops, detection and scoping with indicators, containment decisions under business constraints, eradication and staged recovery, forensic fundamentals (order of volatility, imaging, hashing, chain of custody, legal holds) and attack-framework-driven analysis with MITRE ATT&CK.
Reporting and Communication
Domain 4 · 16%Turning technical findings into action: stakeholder-appropriate reporting, vulnerability and incident metrics (MTTD, MTTR, dwell time, SLA compliance), escalation criteria, regulatory and law-enforcement engagement, coordinated disclosure, and AI governance policy, the domain that separates analysts who find problems from analysts who get them fixed.
Every Certifym practice set below is a full 90-question exam weighted to the official V4 blueprint: 31 Security Operations, 23 Vulnerability Management, 22 Incident Response and Management, and 14 Reporting and Communication items per set, each framed in realistic operational scenarios with explanations that justify why the best answer beats the near misses. CompTIA scores the live exam on a 100-900 scale with 750 to pass; a scaled cut does not map one-to-one onto a raw percentage, so we set the practice pass mark at 83% as a deliberately demanding raw-score proxy, and clearing it here means genuine coverage across all four domains, not luck in the heavy ones.
CompTIA CySA+ (CS0-004) - Practice Exam
90-question CompTIA CySA+ (CS0-004) practice exam. Weighted to the official V4 blueprint: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication…
Subscribe to startFrequently asked questions about CS0-004
What is the CompTIA CySA+ (CS0-004) exam?
CySA+ is CompTIA’s vendor-neutral certification for defensive security practitioners: SOC analysts, threat hunters, vulnerability analysts, and incident responders. It validates that you can apply security concepts under operational conditions: reading logs, triaging alerts, prioritizing vulnerabilities by real risk, running an incident through its lifecycle, and reporting the result to stakeholders who need to act. It is approved under DoD Directive 8140 for a long list of cyber defense work roles.
How many questions are on the CySA+ exam and how long is it?
Up to 85 questions in a 165-minute window. The exam mixes multiple-choice questions with performance-based questions, so you are asked to do things as well as recognize them.
What is the passing score for CS0-004?
750 on a 100-900 scale. Because that is a scaled score rather than a raw percentage, a good working equivalent is roughly 83% on a blueprint-weighted practice exam, the pass mark Certifym uses on its CySA+ practice sets.
Are there prerequisites for CySA+?
There is no enforced prerequisite. CompTIA recommends about four years of hands-on experience in a SOC analyst or vulnerability analyst role, with Network+ and Security+ (or equivalent knowledge) as the assumed foundation.
How hard is the CySA+ exam?
It is scenario-driven and punishes pure memorization. Questions describe realistic telemetry, competing priorities, and messy operational constraints, then ask what a practitioner should do first, next, or instead, so passing depends on operational judgment rather than recall of definitions.
What domains does CS0-004 cover, and how are they weighted?
Four domains: Security Operations (34%), Vulnerability Management (26%), Incident Response and Management (24%), and Reporting and Communication (16%). Security Operations is by far the heaviest, so it should absorb the most study time.
What changed in CS0-004 (V4) compared with CS0-003?
The format carries over unchanged, but the objectives were rebalanced and modernized. V4 adds explicit coverage of AI in security operations, using AI tools for log correlation and reporting, governing their use, and defending against prompt injection, hallucinated findings, sensitive-data exposure, and training-data poisoning. It also formalizes the control taxonomy (physical, technical, and administrative types; deterrent through compensating functions) and leans harder into cloud, hybrid, and critical-infrastructure scenarios.
Should I still take CS0-003, or go straight to CS0-004?
CS0-004 (V4) went live on June 23, 2026 and is the current exam. The older CS0-003 remains available in English through December 22, 2026, but new candidates should prepare for V4, the Certifym practice exams on this page are written to the V4 blueprint.
How long is CySA+ valid and how do I renew it?
The certification is valid for three years, and it is renewed through CompTIA’s continuing education program with 60 CEUs earned during that window.
What is the difference between CySA+ and Security+?
Security+ proves you understand security concepts; CySA+ proves you can apply them under operational conditions. CySA+ sits above Security+ in CompTIA’s cybersecurity pathway and below the expert-level SecurityX, and Security+ (with Network+) is the assumed knowledge foundation going in.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by CompTIA, Inc. CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. All references to the CySA+ certification and its exam objectives are for identification and educational purposes only.
All practice questions, explanations, and study material on this page are original works created by Certifym. They are not actual exam questions and are not derived from any CompTIA examination or copyrighted courseware.