What Is CompTIA CySA+?

Overview

CompTIA CySA+ is a CompTIA credential. Prepare for CompTIA CySA+ V4 (CS0-004). Covers all four domains and what CS0-003 candidates need to know before the December 22, 2026 retirement. This PathKey™ guide summarizes the domains, format, cost signals, eligibility, and renewal pattern so you can decide before you book. Accumentum is a CompTIA Authorized Training Partner and an Army CA and Air Force COOL Approved Vendor. CompTIA sets exam content, fees, and policies.

Accumentum is a CompTIA Authorized Training Partner and an Army CA and Air Force COOL Approved Vendor. CompTIA sets exam content, fees, and policies.

Who it is for

• Aspiring and current cybersecurity analysts preparing for CompTIA CySA+ CS0-004.
• SOC analysts, incident response analysts, threat intelligence analysts, vulnerability management analysts, and cyber defense staff who monitor, triage, escalate, and report.
• Network administrators, systems administrators, help desk staff, and cloud support staff moving into analyst roles.

Exam domains

Weights follow the official outline.

1. 01

   Security Operations Foundations and SOC Workflow

   CS0-004 Domain 1, Security Operations (34%), Build a practical foundation in security operations by learning how SOC teams collect, triage, investigate, escalate, document, and improve security monitoring across enterprise environments, and Explain system and network architecture concepts that matter in security operations, including security architecture components, identity concepts, and logging practices.

2. 02

   Threat Intelligence, Threat Hunting, and Adversary Behavior

   CS0-004 Domain 1, Security Operations (34%), Explain threat intelligence and threat hunting concepts, including frameworks, data sources, indicators, tactics, techniques, procedures, threat actors, confidence levels, and sharing models, and Use frameworks and adversary behavior models to understand how attackers move through environments, abuse identity, evade detection, persist, exfiltrate data, and impact business operations.

3. 03

   Detection Engineering, Log Analysis, and Malicious Activity Investigation

   CS0-004 Domain 1, Security Operations (34%), Analyze indicators of potentially malicious activity across networks, endpoints, cloud, and identity systems using structured investigation methods, and Use SIEM, EDR, packet analysis tools, and threat intelligence platforms, along with firewall, DNS, authentication, and application logs, to support analyst decisions.

4. 04

   Vulnerability Scanning Methods and Assessment Workflows

   CS0-004 Domain 2, Vulnerability Management (26%), Implement the appropriate vulnerability scanning method to find vulnerabilities across systems, networks, and applications, including asset discovery, internal and external scans, credentialed and non-credentialed scans, and active and passive approaches, and Understand scan planning considerations for cloud systems, mobile assets, critical infrastructure, segmented networks, authenticated assets, production systems, and environments with uptime requirements.

5. 05

   Vulnerability Analysis, Prioritization, and Remediation Recommendations

   CS0-004 Domain 2, Vulnerability Management (26%), Analyze output from vulnerability assessment tools and translate technical findings into prioritized remediation actions based on severity, exploitability, asset criticality, exposure, business impact, and compensating controls, and Prioritize vulnerabilities with risk-based approaches that use scoring systems, threat intelligence, exploit availability, and business context.

6. 06

   Incident Response, Incident Management, and Attack Methodology Frameworks

   CS0-004 Domain 3, Incident Response and Management (24%), Outline the incident response process: preparation, detection, analysis, containment, eradication, and recovery, plus post-incident activity and lessons learned, and Use attack methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain to map observed behavior, estimate attacker objectives, and prioritize response actions.

7. 07

   Incident Response Techniques, Evidence Handling, and Recovery Support

   CS0-004 Domain 3, Incident Response and Management (24%), Implement incident response techniques including triage, evidence handling, escalation, remediation, and root cause identification, and Learn how analysts support investigation integrity while coordinating with incident responders, legal teams, management, compliance personnel, and third-party response providers.

8. 08

   Automation, AI in Security Operations, and Analyst Efficiency

   CS0-004 Domain 1, Security Operations (34%), Describe efficiency and process improvement in security operations, including automation, workflows, and processes that reduce repetitive work, and Summarize how AI is used in security operations, including use cases, risks, and governance considerations. This objective is new in CS0-004.

9. 09

   Reporting, Metrics, Communication, and Actionable Recommendations

   CS0-004 Domain 4, Reporting and Communication (16%), Explain vulnerability management reporting and communication, including reports, dashboards, and communication that present findings and support escalation during security events, and Learn how to create meaningful analyst reports that include evidence, severity, scope, business impact, recommended actions, ownership, timelines, limitations, and measurable outcomes.

10. 10

    Control Types, Risk, Compliance, and Continuous Improvement

    CS0-004 Domain 2, Vulnerability Management (26%), Explain control types, risk, and vulnerability management concepts, including the controls, policies, and compliance practices used to manage risk, and Connect analyst findings to frameworks, baselines, policies, procedures, regulatory expectations, business objectives, and management reporting needs.

Exam format and cost

Questions

85

Duration

165 minutes

Format

Confirm question format on the vendor outline

Passing score

750

Cost

Confirm the current U.S. voucher price on CompTIA's store before you buy (often listed in the mid-$300s to low-$400s USD in 2026)

Delivery

Confirm delivery options on the vendor site

Languages

Confirm available languages on the vendor site

Experience and eligibility

There are no enrollment prerequisites, but you should understand networking, operating systems, and basic security concepts before you start. CompTIA recommends about four years of experience in a SOC analyst or vulnerability analyst role for CySA+ V4.

Renewal

Renewal rules for CompTIA CySA+ are set by CompTIA. Many credentials use a multi-year cycle with continuing education, a renewal fee, or a newer exam. Confirm the current cycle on the vendor site.

Roles this credential fits

• Security operations, AI in security operations, threat intelligence and hunting, vulnerability management, incident response and management, and reporting and communication, aligned with CompTIA’s CySA+ V4 (CS0-004) exam objectives.
• Cybersecurity
• Teams standardizing on this credential for hiring or compliance

Official sources

• CompTIA certifications

Always confirm fees, dates, and eligibility on the vendor site before you register. Vendors change outlines and prices without notice.