CompTIA
CompTIA CySA+
CompTIA Cybersecurity Analyst (CySA+) Certification (CS0-004)
An intermediate cybersecurity certification focused on the blue-team analyst role: detecting, analyzing, and responding to threats. A common step after Security+ and listed on US DoD 8570/8140 approved baselines.
What's on the exam
CS0-004 (V4) exam objectives (launched June 23, 2026; CS0-003 English exam retires December 22, 2026)
Security Operations
34%System and network architecture concepts (Zero Trust, ZTNA, SASE, identity, logging) · Analyzing indicators of malicious activity across network, endpoint, cloud, and identity · Tools and techniques (SIEM, EDR/XDR, packet analysis, threat intelligence platforms) · Threat intelligence and threat hunting · Automation and process improvement (SOAR, AI-supported workflows)
Vulnerability Management
26%Vulnerability scanning methods and concepts · Analyzing assessment tool output · Prioritization with CVSS and EPSS · Software bill of materials (SBOM) and supply chain risk · Mitigation controls and remediation response
Incident Response and Management
24%Attack methodology frameworks (Cyber Kill Chain, MITRE ATT&CK) · Incident response lifecycle · Detection and containment · Eradication and recovery · Post-incident activities
Reporting and Communication
16%Vulnerability management reporting · Incident response reporting · Stakeholder communication · Metrics and KPIs
Frequently asked questions
How much does the CompTIA CySA+ cost?
The CompTIA CySA+ costs $439. Exam voucher price on the CompTIA US store; CySA+ V4 (CS0-004) launched June 23, 2026 — the English CS0-003 exam retires December 22, 2026.
How long is the CompTIA CySA+ and how many questions does it have?
Up to 85 questions — 165 minutes.
What do you need to pass the CompTIA CySA+?
750 on a 100–900 scale.
Can you retake the CompTIA CySA+?
No wait for first retake; 14 days between subsequent attempts.
What is the best way to study for the CompTIA CySA+?
Start from the official outline and your primary study materials: the exam is weighted by domain (Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%). Once you've learned the material, spaced-repetition flashcards organized by those domains are an efficient way to retain it and refresh it before test day.
Program in development
We're building a program for this exam. Meanwhile, explore live programs across 84 exams.
Explore programs →