CySA+ Cram Sheet & Last-Minute Review
Updated 16 November 2026 · MCQ + performance-based, Up to 85 questions, 165 minutes, pass 750/900 · CS0-004 since 23 Jun 2026
CySA+ is about interpretation: given a log, a scan or an alert, what is happening and what should the analyst do next? This sheet is for CS0-004, current since 23 June 2026.
The CySA+ mindset
- Read the evidence before the options; decide what it shows, then find the matching answer.
- Prioritise by risk and business impact, not raw severity alone.
- Follow the incident response process; do not jump to eradication before containment.
CySA+ cram sheet by domain
Ordered by exam weight, so the top of the page is where most of the marks are.
Security Operations
34% of the exam- Indicators of malicious activity on hosts, networks and applications
- Log analysis and SIEM correlation; threat intelligence and threat hunting
- Frameworks: MITRE ATT&CK, the Diamond Model, the cyber kill chain
- Automation and orchestration (SOAR) to improve operations
Vulnerability Management
26% of the exam- Scanning: credentialed vs non-credentialed, agent vs agentless, scheduling
- Prioritisation with CVSS plus asset value, exposure and exploitability
- Remediation, compensating controls, exceptions and verification scans
Incident Response and Management
24% of the exam- Phases: preparation, detection and analysis, containment, eradication, recovery, post-incident
- Containment choices: isolation, segmentation, account disablement
- Evidence acquisition and chain of custody; root cause analysis
Reporting and Communication
16% of the exam- Vulnerability and incident reports for technical and executive audiences
- Metrics: mean time to detect and respond, patch and remediation rates
- Stakeholder and regulatory communication during incidents
Formulas and numbers to memorise
| CVSS severity | Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, Critical 9.0–10.0 |
|---|---|
| Diamond Model | Adversary, capability, infrastructure, victim |
| Windows event IDs | 4624 successful logon, 4625 failed logon, 4720 account created, 1102 audit log cleared |
| Exam | CS0-004: up to 85 questions, 165 minutes, pass 750 on 100–900 |
Common CySA+ traps
- Fixing the highest CVSS score first without considering asset criticality and exposure
- Eradicating before containing
- Confusing an indicator of compromise with an indicator of attack
14-day CySA+ cram plan
- Days 1–3Diagnostic across all 4 domains; rank them
- Days 4–8Security Operations (34%): logs, alerts and frameworks; 60 questions a day
- Days 9–10Vulnerability prioritisation and IR phases
- Days 11–12Timed practice with PBQ-style log and scan interpretation
- Days 13–14Miss log, this sheet, then rest
Exam-day tactics
- Budget extra time for the performance-based questions; flag and return.
- About 1 minute 55 seconds per question on average.
CySA+ cram FAQ
When does CySA+ CS0-003 retire?
The English CS0-003 exam retires on 22 December 2026. CS0-004 has been available since 23 June 2026.
What CVSS ranges should I know for CySA+?
Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0.
Keep going
Get ready while the CySA+ bank is built
Start free on another exam today; your account carries over.
Start free