Training course
This is a free, self-paced reading course for CompTIA CySA+ (CS0-004) — the vendor-neutral credential for the defensive side of the wire: SOC analysts, threat hunters, vulnerability analysts, and incident responders. CySA+ is not a definitions exam. It describes realistic telemetry, competing priorities, and messy operational constraints, then asks what a practitioner should do first, next, or instead. This course is written to build the judgment those questions measure, so that a wrong answer on a practice item becomes a reasoning gap you can name rather than a fact you failed to memorize.
The course is organized as one module per official exam domain, in the order CompTIA publishes them in the V4 blueprint, and each module carries the domain’s published weight. That structure is deliberate: Security Operations alone is 34% of the exam, so it is 34% of the emphasis here, and the four modules together map your study time onto the time the exam actually spends. The course is written to the CS0-004 objectives, including the V4 additions — AI in security operations and the risks that come with it, and the formalized control-type and control-function taxonomy. Every module ends with its key terms and suggested further reading, so it works as a reference after the first pass as well as a syllabus during it.
What the course covers
Security Operations
Module 1 · 34%The analyst’s daily work: log and telemetry analysis across network, endpoint, identity, and email; detecting beaconing, tunneling, lateral movement, and living-off-the-land tradecraft; threat intelligence and threat hunting; SIEM tuning and alert triage; and SOAR automation. This module also covers the V4 material on using AI tools in operations — log correlation and reporting — while defending against prompt injection, hallucinated findings, sensitive-data exposure, and training-data poisoning.
Vulnerability Management
Module 2 · 26%Running the full program rather than just running a scanner: scan types and scheduling, including credentialed, agent-based, passive, and critical-infrastructure scanning; validating findings; interpreting CVSS and EPSS; KEV-driven prioritization; choosing between remediation and compensating controls; exceptions and governance; secure-coding flaws such as injection and overflows; cloud misconfigurations; and the V4 control-type and control-function taxonomy.
Incident Response and Management
Module 3 · 24%The lifecycle from preparation through lessons learned, which V4 expands: playbooks and tabletop exercises; detection and scoping with indicators; containment decisions taken under business constraints; eradication and staged recovery; forensic fundamentals — order of volatility, imaging, hashing, chain of custody, and legal holds; and attack-framework-driven analysis with MITRE ATT&CK.
Reporting and Communication
Module 4 · 16%Turning technical findings into action: stakeholder-appropriate reporting, vulnerability and incident metrics such as MTTD, MTTR, dwell time, and SLA compliance; escalation criteria; regulatory and law-enforcement engagement; coordinated disclosure; and AI governance policy. This is the domain that separates analysts who find problems from analysts who get them fixed, and at 16% it is too heavy to leave until the night before.
How to use it
Read a module, then test it immediately with the CySA+ sample questions rather than waiting until you have finished all four. Reading a domain and testing it the same day exposes the difference between recognizing a technique and knowing what to do about it at 2 a.m. — which is the difference CS0-004 measures. Because roughly a third of the exam is Security Operations, resist the temptation to read module 1 once and move on; come back to it between the later modules.
The exam also includes performance-based questions, so reading alone will not carry you. Pair the modules with hands-on time in a lab: pull real logs into a SIEM, run a credentialed scan and triage what it returns, and walk one incident end to end. For exam logistics — question count, timing, the scaled 750 cut score, the CS0-003 retirement date, and renewal — see the CySA+ certification guide.
Course not found.
Frequently asked questions about the CySA+ training course
Is the CySA+ training course free?
Yes. The course is free to read and requires no signup or account. It is funded by the same practice-exam catalogue it sits alongside.
How is the course structured?
One module per official CS0-004 exam domain, in CompTIA’s published order, with each module weighted to the domain’s published percentage — 34%, 26%, 24%, and 16%. Within each module the material is broken into short lessons, followed by key terms and further reading.
Does this replace CompTIA’s official training?
No. CompTIA publishes the authoritative CS0-004 exam objectives along with its own CertMaster courseware, and those are the reference of record. This course is an independent study companion, written to be read quickly and to slot alongside practice questions.
Do I need Security+ before starting?
There is no enforced prerequisite. CompTIA recommends about four years of hands-on experience in a SOC analyst or vulnerability analyst role, with Network+ and Security+ or equivalent knowledge as the assumed foundation. If you are missing that foundation, work through the Security+ course first — this course assumes you already know what the concepts are and focuses on applying them.
What should I do after finishing the course?
Move to blueprint-weighted practice questions and work until you are clearing the pass mark consistently across all four domains rather than by leaning on Security Operations, which is heavy enough to hide weakness elsewhere. Then book the exam through Pearson VUE.
Is the course written for CS0-004 or the older CS0-003?
CS0-004. The V4 exam went live on June 23, 2026, and this course follows its objectives, including the AI-in-security-operations material and the formalized control taxonomy that V3 did not have. CS0-003 remains available in English through December 22, 2026, but new candidates should prepare for V4. CompTIA can revise objectives at any time; verify the current exam objectives on the CompTIA site before you schedule.
Trademark notice & independence. Certifym.net is operated by Certifym Exam Services, LLC and is not affiliated with, endorsed by, or sponsored by CompTIA, Inc. CompTIA® and CySA+® are registered trademarks of CompTIA, Inc. Use of these marks is solely to identify the certification for which these study materials are intended. The CS0-004 exam objectives are the property of CompTIA, Inc.; candidates should review the official, current objectives directly on the CompTIA site.
All course content, questions, answers, and explanations on Certifym are original content created for study purposes. They are not actual CompTIA training materials or examination questions and are not represented as such. Studying with these materials does not guarantee a passing result on any live certification exam. Exam requirements, format, domain weights, pricing, and renewal policies are set by CompTIA and may change; always verify current details on the CompTIA site before scheduling your exam.