CySA+ CS0-004 Exam Guide: Domains and Passing Score

CompTIA Cybersecurity Analyst (CySA+) is the intermediate, hands-on certification for security analysts: the people who watch the telemetry, triage alerts, manage vulnerabilities and run the first hours of an incident. It is the natural next step after Security+ for anyone heading into a security operations centre (SOC) role.

The current version is CySA+ V4, exam code CS0-004, which launched on 23 June 2026. The previous version, CS0-003, retires in English on 22 December 2026, with translated versions following on 23 March 2027.

The CS0-004 exam format

CS0-004 has a maximum of 85 questions in 165 minutes, combining multiple-choice and performance-based questions (PBQs). The PBQs simulate analyst work: reading logs, interpreting scan output, prioritising vulnerabilities, or choosing the next step in an incident.

Scores are reported on a 100–900 scale and the passing score is 750. At almost two minutes per question you have more time than on Security+, but the PBQs use it — budget for them up front.

The 4 CySA+ CS0-004 domains

Security Operations remains the heaviest domain, and Incident Response and Management gained weight compared with V3.

• Security Operations (34%) — monitoring and analysing activity across systems and networks, threat intelligence and threat hunting, and improving operations through automation.
• Vulnerability Management (26%) — running and interpreting scans, prioritising findings, and recommending controls and mitigations.
• Incident Response and Management (24%) — attack frameworks, detection and analysis, containment, eradication and recovery, and post-incident activity.
• Reporting and Communication (16%) — vulnerability and incident reporting, metrics, and communicating with stakeholders.

CS0-003 or CS0-004?

Compared with CS0-003, CS0-004 shifts weight from Vulnerability Management toward Incident Response and Management. Both lead to the same CySA+ certification.

• If you are booked on CS0-003 in English, you must sit it by 22 December 2026.
• If you are starting now, study for CS0-004: it is the current version and study material for it is available.

Who CySA+ is for

There is no formal prerequisite, but CompTIA positions CySA+ for candidates with Security+-level knowledge and several years of hands-on security analyst or incident-response experience. Passing CySA+ also renews a Security+ certification, which makes it a common second step on the CompTIA security pathway.

A study plan that works

CySA+ is less about recall and more about interpretation: given this log, scan or alert, what is happening and what do you do next?

• Take a diagnostic and rank the four domains, weighted toward Security Operations (34%).
• Practise reading real tool output — SIEM queries, vulnerability scan reports, packet captures — not just definitions.
• Use spaced repetition for frameworks (MITRE ATT&CK, the Diamond Model, the cyber kill chain) and scoring systems such as CVSS.
• Run timed PBQ-style drills so the hands-on questions do not eat your clock.
• Book when practice results are stable across all four domains.