CompTIA CySA+ (CS0-004)
CySA+ is CompTIA's analyst-level security certification, a rung above Security+. It covers what a working SOC actually does: continuous monitoring, threat detection and hunting, vulnerability triage, and incident response. Version CS0-004 launched on 23 June 2026 and rebalanced the exam around four domains, with Security Operations alone accounting for 34%. It is vendor-neutral and commonly requested for SOC analyst, threat hunter and vulnerability analyst roles.
- Up to 85
- Questions
- 165 min
- Duration
- 750 on a 100 to 900 scale
- Passing score
- Varies by region
- Exam cost
multiple-choice and performance-based
confirm on comptia.org
Exam facts reviewed July 2026 · Independent study resource, not affiliated with CompTIA
Who should take it
Security practitioners moving from generalist to analyst work: SOC tier 1/2 analysts, vulnerability management specialists, and incident responders. CompTIA recommends Network+ and Security+ level knowledge (or equivalent) plus around four years of hands-on experience as an incident response, SOC or vulnerability analyst. None of that is enforced, but CySA+ assumes you already know the Security+ material.
Skills measured
Domains and weightings as published by CompTIA. Full objectives →
- 34%Security Operations
- 26%Vulnerability Management
- 24%Incident Response and Management
- 16%Reporting and Communication
What’s inside
What you get on Kwizza for this certification. It is free, and you do not need an account to start.
- 300
- Practice questions
- 3
- Full exams
- 4
- Domains covered
- Free
- Cost
weighted to the official blueprint
every answer explained
Prepare with Kwizza
- Free practice exam: full-length, weighted to the official blueprint, every answer explained
- Study guide: focus areas for each domain, common mistakes, and exam-day tips
- Exam objectives: the official domains, broken down skill by skill
- Sample questions: real questions from our bank, with answers and explanations
- How our exams are made: the quality checks behind every question
Frequently asked questions
- What is the difference between Security+ and CySA+?
- Security+ establishes broad security fundamentals. CySA+ is about applying them as an analyst. Where Security+ asks what a control is, CySA+ hands you log output, scan results or an active incident and asks what you do next. CySA+ is also weighted toward operations: a third of the exam is Security Operations alone.
- How many questions is CS0-004, and how long do I get?
- A maximum of 85 questions in 165 minutes, mixing multiple-choice with performance-based items. The passing score is 750 on CompTIA's 100 to 900 scaled range, which is not a straight percentage.
- Do I need Security+ before taking CySA+?
- It is not enforced. CompTIA recommends Network+ and Security+ level knowledge plus roughly four years of hands-on analyst experience. The exam is written on that assumption and does not re-teach fundamentals.
- What changed in CS0-004 compared with CS0-003?
- CS0-004 launched on 23 June 2026 and restructured the exam into four domains: Security Operations at 34%, Vulnerability Management at 26%, Incident Response and Management at 24%, and Reporting and Communication at 16%. Practice built against the older weightings will send your study time to the wrong places.
- Is CySA+ worth it?
- It is one of the few vendor-neutral credentials aimed squarely at detection and response work rather than general security knowledge, and it maps closely to what SOC and vulnerability analyst job descriptions ask for. It is also a common stepping stone toward CISSP or a specialist security track.
- Are Kwizza's practice questions real exam questions?
- No, and that is deliberate. Every question is original, written against CompTIA's published CS0-004 objectives and checked for duplicates, broken citations and item-writing flaws. Reproducing real exam content violates CompTIA's NDA and teaches you less. These test the same skills at the same difficulty with fresh scenarios.
Related certifications
- CompTIA Security+ (SY0-701): The recommended foundation, since CySA+ assumes this material
- Cisco CCNA (200-301): The networking depth that makes traffic and log analysis much easier