Training course

This is a free, self-paced reading course for CompTIA CySA+ (CS0-004), the vendor-neutral credential for the defensive side of the wire: SOC analysts, threat hunters, vulnerability analysts, and incident responders. CySA+ is not a definitions exam. It describes realistic telemetry, competing priorities, and messy operational constraints, then asks what a practitioner should do first, next, or instead. This course is written to build the judgment those questions measure, so that a wrong answer on a practice item becomes a reasoning gap you can name rather than a fact you failed to memorize.

The course is organized as one module per official exam domain, in the order CompTIA publishes them in the V4 blueprint, and each module carries the domain’s published weight. That structure is deliberate: Security Operations alone is 34% of the exam, so it is 34% of the emphasis here, and the four modules together map your study time onto the time the exam actually spends. The course is written to the CS0-004 objectives, including the V4 additions: AI in security operations and the risks that come with it, and the formalized control-type and control-function taxonomy. Every lesson ends with its key terms and suggested further reading, so it works as a reference after the first pass as well as a syllabus during it.

CS0-004 Intermediate level 4 modules Domain-weighted Self-paced Free account

What the course covers

Security Operations

Module 1 · 34%

The analyst’s daily work: log and telemetry analysis across network, endpoint, identity, and email; detecting beaconing, tunneling, lateral movement, and living-off-the-land tradecraft; threat intelligence and threat hunting; SIEM tuning and alert triage; and SOAR automation. This module also covers the V4 material on using AI tools in operations, log correlation and reporting, while defending against prompt injection, hallucinated findings, sensitive-data exposure, and training-data poisoning.

Vulnerability Management

Module 2 · 26%

Running the full program rather than just running a scanner: scan types and scheduling, including credentialed, agent-based, passive, and critical-infrastructure scanning; validating findings; interpreting CVSS and EPSS; KEV-driven prioritization; choosing between remediation and compensating controls; exceptions and governance; secure-coding flaws such as injection and overflows; cloud misconfigurations; and the V4 control-type and control-function taxonomy.

Incident Response and Management

Module 3 · 24%

The lifecycle from preparation through lessons learned, which V4 expands: playbooks and tabletop exercises; detection and scoping with indicators; containment decisions taken under business constraints; eradication and staged recovery; forensic fundamentals, order of volatility, imaging, hashing, chain of custody, and legal holds; and attack-framework-driven analysis with MITRE ATT&CK.

Reporting and Communication

Module 4 · 16%

Turning technical findings into action: stakeholder-appropriate reporting, vulnerability and incident metrics such as MTTD, MTTR, dwell time, and SLA compliance; escalation criteria; regulatory and law-enforcement engagement; coordinated disclosure; and AI governance policy. This is the domain that separates analysts who find problems from analysts who get them fixed, and at 16% it is too heavy to leave until the night before.

How to use it

Read a module, then test it immediately with the CySA+ sample questions rather than waiting until you have finished all four. Reading a domain and testing it the same day exposes the difference between recognizing a technique and knowing what to do about it at 2 a.m., which is the difference CS0-004 measures. Because roughly a third of the exam is Security Operations, resist the temptation to read module 1 once and move on; come back to it between the later modules. The course modules themselves open once you are signed in to a free Certifym account.

The exam also includes performance-based questions, so reading alone will not carry you. Pair the modules with hands-on time in a lab: pull real logs into a SIEM, run a credentialed scan and triage what it returns, and walk one incident end to end. For exam logistics (question count, timing, the scaled 750 cut score, the CS0-003 retirement date, and renewal) see the CySA+ certification guide.

CompTIA CySA+ (CS0-004)

One module per CS0-004 exam domain, weighted the way CompTIA weights them.

A self-paced reading course for CompTIA CySA+ (CS0-004), the vendor-neutral credential for the defensive side of the wire: SOC analysts, threat hunters, vulnerability analysts, and incident responders. The course is organized as one module per official V4 exam domain, in the order CompTIA publishes them, and each module carries the domain's published weight, so the time you spend maps onto the time the exam spends.

CySA+ is not a definitions exam. It describes realistic telemetry, competing priorities, and messy operational constraints, then asks what a practitioner should do first, next, or instead. The lessons are written to build that judgment: reading flow and endpoint evidence to separate beaconing from legitimate polling, prioritizing vulnerabilities by exploitation and exposure rather than by score, choosing a containment strategy that does not destroy the evidence you still need, and reporting all of it to people who can act. The V4 additions are covered throughout — AI in security operations and the risks that come with it, and the formalized control-type and control-function taxonomy.

The course assumes the foundation CompTIA assumes: networking and core security concepts at roughly the Network+ and Security+ level, and hands-on exposure to a security operations or vulnerability analyst role. Pair it with lab time, because the exam includes performance-based questions and reading alone will not carry you. Every lesson ends with its key terms and further reading, so the material works as a reference after the first pass as well as a syllabus during it. Certifym is an independent study publisher and is not affiliated with, endorsed by, or sponsored by CompTIA, Inc.

Module 1: Security Operations 34% of exam

The heaviest domain on CS0-004 and the analyst's daily work. You start with the architecture that decides what you can see at all, then work through network, endpoint, identity, email, and web telemetry — detecting beaconing and command-and-control, tunneling and exfiltration, living-off-the-land tradecraft, and lateral movement from authentication evidence.The second half covers the disciplines built on that telemetry: malware triage, threat intelligence and its operational use, structured threat hunting, SIEM correlation and tuning, alert triage and escalation, and SOAR automation. The module closes on the V4 material for using AI in security operations while defending against prompt injection, hallucinated findings, sensitive-data exposure, and poisoning.

1.1 Where telemetry comes from and why architecture decides what you can see 5 min Free preview
1.2 Reading network evidence: flow records, packet capture, and protocol metadata 5 min 🔒
1.3 Detecting beaconing and command-and-control traffic 5 min 🔒
1.4 Tunneling, covert channels, and data exfiltration 5 min 🔒
1.5 Endpoint evidence: process ancestry, command lines, and persistence 5 min 🔒
1.6 Living off the land: abusing built-in tooling 5 min 🔒
1.7 Identity telemetry, credential abuse, and lateral movement 5 min 🔒
1.8 Email analysis: headers, authentication, and phishing triage 5 min 🔒
1.9 Web, proxy, and application log analysis 5 min 🔒
1.10 Malware triage: static, dynamic, and sandbox analysis 5 min 🔒
1.11 Threat intelligence: sources, confidence, and the intelligence cycle 5 min 🔒
1.12 Threat actors, TTPs, and reasoning about your attack surface 5 min 🔒
1.13 Threat hunting: forming hypotheses and turning hunts into detections 5 min 🔒
1.14 SIEM correlation, rule writing, and tuning 5 min 🔒
1.15 Alert triage: prioritization, escalation, and analyst workflow 6 min 🔒
1.16 SOAR, playbooks, and automating the routine 5 min 🔒
1.17 AI in security operations: uses, limits, and specific risks 5 min 🔒

Module 2: Vulnerability Management 26% of exam

Running the whole program rather than running a scanner. You begin with asset discovery and inventory, because everything downstream is capped by it, then work through scan types — credentialed, uncredentialed, agent-based, and passive — scanning cloud, container, and critical-infrastructure environments safely, scheduling and scope, and validating findings against false positives and the far more dangerous false negatives.From there the module moves to interpretation and decision-making: the CVE and CWE ecosystem, reading CVSS vectors rather than scores, risk-based prioritization using exploitation evidence and exposure, the web application and memory flaw classes you will be asked to judge, cloud and identity misconfiguration, the V4 control-type and control-function taxonomy, and the governance that turns findings into fixes.

2.1 Asset discovery and inventory: the foundation of the program 5 min 🔒
2.2 Scan types: credentialed, uncredentialed, agent-based, and passive 5 min 🔒
2.3 Scanning cloud, containers, and critical infrastructure safely 5 min 🔒
2.4 Scan scheduling, scope, and operational risk 5 min 🔒
2.5 Validating findings: false positives, false negatives, and evidence 5 min 🔒
2.6 The vulnerability data ecosystem: CVE, CWE, and vendor advisories 5 min 🔒
2.7 Interpreting CVSS: base, threat, and environmental metrics 5 min 🔒
2.8 Risk-based prioritization: EPSS, KEV, exposure, and asset value 5 min Free preview
2.9 Web application vulnerabilities and how they appear in findings 5 min 🔒
2.10 Software and memory flaws: overflows, race conditions, and error handling 5 min 🔒
2.11 Cloud and identity misconfigurations 5 min 🔒
2.12 Controls: types, functions, and choosing remediation or mitigation 5 min 🔒
2.13 Program governance: patching workflow, SLAs, and exceptions 5 min 🔒

Module 3: Incident Response and Management 24% of exam

The lifecycle from preparation through lessons learned. You cover the response plan and the authority it must define, the preparation that decides how well an incident goes — retention, tooling, out-of-band communication, and playbooks — and the exercises that test whether any of it works.The response itself follows: turning an alert into a declared incident without destroying volatile evidence, timeline and scope analysis, impact assessment and data exposure, attack-framework-driven analysis with MITRE ATT&CK and the Diamond Model, containment tradeoffs and timing, eradication and staged recovery, forensic acquisition and evidence integrity, and the root cause analysis that turns an incident into a change.

3.1 The incident response lifecycle and the plan behind it 5 min 🔒
3.2 Preparation: tooling, logging, and writing playbooks that work 5 min 🔒
3.3 Testing readiness: tabletops, simulations, and exercise design 5 min 🔒
3.4 Detection and analysis: from alert to declared incident 5 min 🔒
3.5 Impact analysis: scope, data exposure, and business consequence 5 min 🔒
3.6 Attack frameworks: ATT&CK, the kill chain, and the Diamond Model 5 min 🔒
3.7 Containment: strategies, timing, and the tradeoffs 5 min 🔒
3.8 Eradication and recovery: removing access and restoring safely 5 min 🔒
3.9 Forensic fundamentals: volatility, acquisition, and imaging 4 min 🔒
3.10 Evidence integrity: hashing, chain of custody, and legal hold 5 min 🔒
3.11 Root cause analysis and lessons learned 5 min 🔒
3.12 Incident classification, severity models, and prioritizing concurrent incidents 5 min 🔒

Module 4: Reporting and Communication 16% of exam

The domain that separates analysts who find problems from analysts who get them fixed. You work through vulnerability reporting that a remediation owner can act on, the metrics that describe risk reduction rather than activity, and stakeholder communication pitched to the decision each audience actually makes.The module then covers the organizational obstacles that stall remediation and how to escalate them, incident reporting and regulatory notification on their own clocks, response metrics such as dwell time and mean time to contain, coordinated disclosure and external parties, and the governance layer including AI acceptable-use policy and the feedback loops that make a program improve.

4.1 Vulnerability reports: structure, evidence, and recommendations 5 min 🔒
4.2 Vulnerability management metrics and KPIs 5 min 🔒
4.3 Stakeholders: identifying audiences and pitching to them 5 min 🔒
4.4 Inhibitors to remediation and how to escalate them 6 min 🔒
4.5 Incident reporting, declaration, and regulatory notification 5 min 🔒
4.6 Incident response metrics: MTTD, MTTR, dwell time, and SLAs 5 min 🔒
4.7 Coordinated disclosure and working with external parties 5 min 🔒
4.8 Governance, AI policy, and continuous improvement 5 min 🔒

Frequently asked questions about the CySA+ training course

Is the CySA+ training course free?

Yes. The course costs nothing to read and opens once you are signed in to a free Certifym account, no payment and no card.

How is the course structured?

One module per official CS0-004 exam domain, in CompTIA’s published order, with each module weighted to the domain’s published percentage: 34%, 26%, 24%, and 16%. Within each module the material is broken into short lessons, followed by key terms and further reading.

Does this replace CompTIA’s official training?

No. CompTIA publishes the authoritative CS0-004 exam objectives along with its own CertMaster courseware, and those are the reference of record. This course is an independent study companion, written to be read quickly and to slot alongside practice questions.

Do I need Security+ before starting?

There is no enforced prerequisite. CompTIA recommends about four years of hands-on experience in a SOC analyst or vulnerability analyst role, with Network+ and Security+ or equivalent knowledge as the assumed foundation. If you are missing that foundation, work through the Security+ course first, this course assumes you already know what the concepts are and focuses on applying them.

What should I do after finishing the course?

Move to blueprint-weighted practice questions and work until you are clearing the pass mark consistently across all four domains rather than by leaning on Security Operations, which is heavy enough to hide weakness elsewhere. Then book the exam through Pearson VUE.

Is the course written for CS0-004 or the older CS0-003?

CS0-004. The V4 exam went live on June 23, 2026, and this course follows its objectives, including the AI-in-security-operations material and the formalized control taxonomy that V3 did not have. CS0-003 remains available in English through December 22, 2026, but new candidates should prepare for V4. CompTIA can revise objectives at any time; verify the current exam objectives on the CompTIA site before you schedule.

Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by CompTIA, Inc. CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. Use of these marks is solely to identify the certification for which these study materials are intended. The CS0-004 exam objectives are the property of CompTIA, Inc.; candidates should review the official, current objectives directly on the CompTIA site.

All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual CompTIA training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by CompTIA and may change; always verify current details on the CompTIA site before scheduling your exam.