The short version
CS0-004 is the current version (V4) of CompTIA’s CySA+ exam, aimed at security analysts who detect, analyze, and respond to threats. It has a maximum of 85 questions, 165 minutes, and a passing score of 750 on a scale of 100 to 900. The skills list comes from CompTIA’s CS0-004 exam objectives, document version 2.0, and the exam launched on June 23, 2026.
What the exam is
The full name is CompTIA Cybersecurity Analyst (CySA+). It sits in the middle of the security track: harder than entry-level Security+, but focused on day-to-day analyst work rather than on architecture or management. CompTIA describes the target skills as understanding incident response and vulnerability management, spotting indicators of malicious activity, using tools and frameworks to prioritize vulnerabilities and respond to incidents, and communicating about all of it.
Think of the exam as a day in a security operations center. You read a log line, decide what it means, choose the right tool, rank a pile of scanner findings, decide what to contain first, and then write the summary for people who are not technical. Questions lean on scenarios (“given a scenario” appears in many objectives), so memorizing definitions alone will not carry you.
What changed in V4
CS0-004 replaces CS0-003. CompTIA lists the English CS0-003 exam as retiring on December 22, 2026, so if you start now, V4 is the exam to prepare for. Compared with the old objectives, V4 adds a full objective on AI in security operations (risks such as hallucinations and model poisoning, plus governance and use cases). It also names EPSS next to CVSS for scoring, covers Zero Trust and SASE, adds identity-based indicators such as impossible travel, and lists tools such as Suricata, Zeek, YARA, Trivy, and Checkov. Study material written for CS0-003 will miss some of this.
Who it is for
CompTIA recommends about four years of hands-on experience as a level 2 SOC analyst or a vulnerability analyst. That is a recommendation, not a rule. It fits SOC analysts, vulnerability analysts, incident responders, and administrators or network engineers who are moving into security operations. The prerequisites page explains what to know before you start.
Format at a glance
| Item | What CompTIA says |
|---|---|
| Exam code | CS0-004 (V4) |
| Number of questions | Maximum of 85 |
| Question types | Multiple-choice and performance-based |
| Time | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Language | English; French, Japanese, Spanish, and Portuguese are listed as coming soon |
| Recommended experience | About 4 years as a SOC analyst (level 2) or vulnerability analyst |
More detail, including retakes and delivery, is on the exam format page.
The four domains and their weightings
| Domain | Weighting |
|---|---|
| 1.0 Security Operations | 34% |
| 2.0 Vulnerability Management | 26% |
| 3.0 Incident Response and Management | 24% |
| 4.0 Reporting and Communication | 16% |
Security Operations
The largest domain. It covers logging and architecture concepts, indicators of malicious activity on networks, hosts, applications, cloud, and identities, the analyst toolset (Wireshark, Zeek, YARA, CyberChef, SIEM, EDR and more), threat intelligence and hunting, process improvement with automation, and the new AI objective.
Vulnerability Management
Scan types and planning, reading output from scanners and assessment tools, prioritizing findings with CVSS, EPSS, and context, mitigation choices, and control, risk, and application security concepts.
Incident Response and Management
Attack frameworks (Cyber Kill Chain, Diamond Model, MITRE ATT&CK), the phases of incident response, and the practical steps: triage, timelines, evidence handling, isolation, escalation, restoration, and root cause analysis.
Reporting and Communication
What to report to whom after a scan or an incident, what slows remediation down, and which metrics (such as mean time to detect or false-positive rate) tell a useful story.
Official source
For the vendor’s own details, see the CompTIA CySA+ V4 page. It is the final authority if anything here differs.
More guides for CS0-004
- CS0-004 Study Plan: 4-Week and 8-Week
- CS0-004 Sample Questions With Answers
- Is the CS0-004 Exam Hard?
- CS0-004 Renewal and Retakes Explained
- Is CS0-004 Worth It? An Honest Look
- CS0-004 Cheat Sheet: Key Facts to Review
- SY0-801 vs CS0-004: Which Exam First?
Next step
Read the domains explained page to see where your time should go. When you want to check yourself, our CS0-004 practice tests are original practice sets built around these four domains.
Frequently asked questions
Does CySA+ expire?
Yes. CompTIA states that CySA+ lasts three years and can be renewed through its continuing education program, which lists 60 continuing education units for CySA+. Check CompTIA’s renewal pages for current rules.
Is CS0-003 still available?
For now, yes, but CompTIA lists the English CS0-003 exam as retiring on December 22, 2026. Translated versions are listed as retiring on March 23, 2027.
Do I need Security+ first?
CompTIA does not list a required prerequisite on the pages we checked. The recommended experience is the guide, not a certificate.