Updated 1 Nov 2026 · 5 min read
On this page
What the CompTIA CySA+ CS0-004 is and who it is for
CS0-004 is the exam code for CompTIA Cybersecurity Analyst (CySA+) V4, which CompTIA launched on 23 June 2026. CompTIA describes CySA+ as an intermediate-level, vendor-neutral certification that validates your ability to detect, analyse and respond to threats in security operations and vulnerability management roles. On the CompTIA Cybersecurity Career Pathway it sits between Security+ and SecurityX.
It is not an entry-level exam. CompTIA recommends about four years in a SOC analyst or vulnerability analyst role, plus Network+ and Security+ or equivalent knowledge. Security+ is not a formal prerequisite, but CySA+ is aimed at people moving into specialised roles such as SOC analyst, incident responder and threat intelligence analyst.
The previous version, CS0-003, still runs alongside it. CompTIA says the English CS0-003 exam retires on 22 December 2026, and the Japanese, Portuguese and Spanish versions on 23 March 2027. For the most up-to-date content, CompTIA points you to V4.
CompTIA CySA+ CS0-004 at a glance
| Item | Detail |
|---|---|
| Exam code | CS0-004 (exam version V4) |
| Questions | A maximum of 85, multiple choice and performance-based |
| Time allowed | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Exam fee | US$439 for a single voucher on CompTIA's US store |
| Languages | English, with French, Japanese, Spanish and Portuguese coming soon |
| Where you sit it | A Pearson testing centre or online with remote proctoring |
| Certification valid for | Three years, renewable through CompTIA continuing education |
A June 2026 CompTIA blog post quoted US$425, but the Buy Now section of the CySA+ V4 page lists US$439, and prices vary by country. Check the current figure before you budget.
What is on the exam
Security operations (34%). The largest domain. It covers security architecture, identity concepts and logging, then spotting malicious activity across networks, endpoints, cloud and identity systems, and picking the right tool: SIEM, EDR, packet analysis or a threat intelligence platform. Threat hunting and automation sit here too, along with AI in security operations: use cases, risks and governance.
Vulnerability management (26%). Choosing the right scanning method, reading the output of assessment tools, then prioritising with scoring systems, threat intelligence and business context to decide what gets fixed first. CompTIA says V4 expands EPSS-based prioritisation and adds more on SBOMs and software supply chain risk. Control types, policies and compliance close the domain.
Incident response and management (24%). Attack methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain, the phases of the incident response process from preparation through detection, analysis, containment, eradication and recovery, and the hands-on techniques: triage, evidence handling, escalation, remediation and root cause identification.
Reporting and communication (16%). The smallest domain, but not a free one: vulnerability reports and dashboards, communication during escalation, incident documentation, post-incident reviews, and metrics such as detection time, response time and remediation effectiveness.
Why people fail it
The first trap is studying for the old exam. CS0-004 is only a few months old, and much of the preparation material around was written for CS0-003. V4 is not a relabelled V3. Compared with CS0-003, security operations went from 33% to 34%, vulnerability management dropped from 30% to 26%, incident response rose from 20% to 24% and reporting went from 17% to 16%. AI in security operations, ZTNA and SASE, and EPSS-based prioritisation are new or expanded. Practising on a CS0-003 bank means practising the wrong balance.
The second is the performance-based questions. CompTIA says they may ask you to analyse SIEM alerts, review logs, investigate indicators of compromise and prioritise vulnerabilities. You cannot learn that from a list of facts. Knowing what a remediation standard is does not mean you can read a scan report and say which servers breach it, or read connection logs and say which host is beaconing out and which process owns the connection.
The third is reading the question too fast. CySA+ scenarios are built around the word "most": the most likely attack, the first action to take, the vulnerability to fix first. Several answers are often true, but only one fits the context given.
A study plan that fits the exam
Seven weeks suits someone with a few years of security work behind them, split roughly by the domain weights.
- Week 1: architecture and indicators. Identity concepts, logging, and what malicious activity looks like on a network, an endpoint, in the cloud and in an identity provider. Finish with the free CySA+ CS0-004 practice questions to see where you stand.
- Week 2: tools, hunting and AI. SIEM queries, EDR alerts, packet captures, threat intelligence sources, threat hunting methods, SOAR-style automation and the AI objective, including risks such as hallucinations and data exposure.
- Week 3: scanning. Scan types and when to use each, then practise reading real scanner output until you can tell a genuine finding from noise.
- Week 4: prioritisation and controls. CVSS, EPSS, asset value and business context, SBOMs, compensating controls, exceptions and compliance. Rank the same findings several ways until the logic is automatic.
- Week 5: incident response. ATT&CK and the Kill Chain, the response phases in order, evidence handling and root cause analysis. Work through log-based scenarios end to end.
- Week 6: reporting, then review. Half the week on reports, dashboards, post-incident reviews and metrics, half revisiting your weakest week so far.
- Week 7: timed runs. Use the questions-only copy in the CySA+ CS0-004 practice question pack for full timed runs, then read the explanation for every miss, especially the worked performance-based simulations.
On exam day
You can sit CySA+ at a Pearson testing centre or online through remote proctoring. A CompTIA voucher must be used to register within 12 months of receiving the code, so book before it runs out.
You get 165 minutes for up to 85 questions, which is a little under two minutes each on average. Performance-based questions take far longer, so do not let one eat your clock. Flag anything slow and come back to it. The pass mark of 750 is on a scaled range of 100 to 900, not a percentage.
Frequently asked questions
Should I take CS0-003 or CS0-004?
CompTIA says the English CS0-003 exam remains available until 22 December 2026. If you have already prepared for it and can sit before then, finishing it is reasonable. If you are starting now, prepare for CS0-004, where CompTIA's new learning products and updated content are.
What happens if I fail?
CompTIA does not require any wait between your first and second attempt. Before a third or later attempt you must wait at least 14 calendar days from your last one. You pay the full exam price each time, as CompTIA offers no free retakes or retake discounts, unless you bought a voucher with Retake Assurance, which CompTIA lists at US$579 and which covers two attempts within 12 months.
Is the practice question pack enough on its own?
It is practice, not a course. The 95 questions, multiple choice plus performance-based simulations with every step explained, show you how the V4 objectives are tested and where your gaps are. They do not replace studying the objectives or hands-on time with a SIEM, a scanner and real logs. Learn first, then use the pack to check it stuck and to rehearse under time.
How do I keep CySA+ once I pass?
It is valid for three years. You renew by earning 60 continuing education units, with a CE fee of US$150 for the three-year period, or by passing a higher-level CompTIA certification or the latest CySA+ exam, which need no fee. CompTIA also says earning CySA+ renews eligible lower-level certifications such as Security+.
Try the free questions, then get all 95 CySA+ CS0-004 practice questions with full explanations for US$39, pass or your money back: get the CySA+ CS0-004 pack.
Sources
The official pages the facts in this guide were checked against.
- comptia.org/en-us/certifications/cybersecurity-analyst/v4/
- comptia.org/en-us/blog/what-is-comptia-cysa-certification/
- comptia.org/en-us/blog/the-new-comptia-cybersecurity-analyst-cysa-your-questions-answered/
- comptia.org/en-us/certifications/cybersecurity-analyst/
- comptia.org/en-us/certifications/cybersecurity-analyst/v3/
- comptia.org/en-us/about-us/news/press-releases/CompTIA-updates-CySA-certification-to-address-rising-cyber-threats-and-evolving-skills-needs/
- comptia.org/en-us/resources/test-policies/comptia-certification-retake-policy/
- comptia.org/en-us/resources/ce/learn/continuing-education-renewal-fees/
- comptia.org/en-us/certifications/continuing-education/
What people say about this pack
Latest dumps are available at Cert Stash. I gave my CS0-004 certification exam and achieved 92% marks by studying from these sample exams. I suggest Cert Stash to everyone taking the CompTIA CS0-004 exam.