Skip to content
CertGPS

CompTIA Cybersecurity Analyst+

Tests a security analyst's ability to detect threats, prioritize vulnerabilities and handle incidents using real tool output, now on the CS0-004 exam

IntermediateCompTIA

The exam

Exam cost
$439
Study time
3-6 months
Passing score
750 (scale of 100–900)
Valid for
3 years

Before you book

  • No prerequisite certification; Security+ recommended
  • Recommended: about 4 years of hands-on experience as a SOC analyst (level 2) or vulnerability analyst

What it covers

Security domains

Career

US pay and outlook from the Bureau of Labor Statistics for the closest BLS occupation to each role this certification fits. BLS doesn't report pay by certification, and counts most of these roles only within a wider occupation, so the figures describe that occupation, not the role or the credential.

Where people with it work

  1. Entry level

  2. Mid level

  3. Senior level

Where it leads

  1. CompTIA Security+

    Entry

    Comes before. Recommended foundation for CySA+, though CompTIA lets experienced analysts skip it

  2. CompTIA Cybersecurity Analyst+

    You are here

  3. GIAC Certified Incident Handler

    Intermediate

    Next step. GIAC's incident handling exam adds CyberLive hands-on items to similar analyst ground

  4. Certified Information Systems Security Professional

    Expert

    Next step. Management-level next step, and CySA+ can waive one of its five experience years

Study guide

Last updated

CySA+ Study Guide: CS0-003 Retires in December, CS0-004 Is Live

CySA+ is CompTIA's exam for the analyst who works the alert queue: reading indicators, ranking vulnerabilities and taking an incident from triage to root cause. It sits above Security+ and assumes about four years in a security operations center (SOC) or vulnerability role. Settle the version question before anything else. CS0-004 (V4) launched on June 23, 2026, and the English CS0-003 exam retires on December 22, 2026.

Who CySA+ is for, and who should wait

It suits a level 1 SOC analyst ready to move up, a vulnerability management analyst who already runs scanners and argues about patch order, and the system administrator who has become the team's incident handler. CompTIA writes V4 for roughly four years of hands-on work as a level 2 SOC analyst or vulnerability analyst, which is more than the "intermediate" label suggests. It also lists CySA+ as meeting US Department of Defense 8140 requirements, which matters if you work on a defense contract.

If control types, ports and basic cryptography still feel uncertain, take Security+ first. CompTIA recommends it but doesn't require it. If your job is mostly incident handling and your employer pays for SANS training, GCIH covers similar ground with hands-on CyberLive questions. And if you're aiming at security management rather than deeper analysis, plan toward CISSP instead.

CS0-004 and CS0-003 side by side

CS0-004 (V4)CS0-003 (V3)
StatusLaunched June 23, 2026English exam retires December 22, 2026; Japanese, Portuguese and Spanish on March 23, 2027
QuestionsUp to 85, multiple-choice and performance-basedSame
Time165 minutesSame
Passing score750 on a 100–900 scaleSame
Price (US list)$439 voucher; $579 with one retakeOnly the $579 voucher with retake is listed
LanguagesEnglish; French, Japanese, Spanish and Portuguese listed as coming soonEnglish, Japanese, Portuguese, Spanish
DeliveryPearson VUE test center or online proctoringSame
Recommended experienceAbout four years as a level 2 SOC analyst or vulnerability analystNetwork+ and Security+ or equivalent, plus four years in incident response or a SOC
ValidityThree years; renew with 60 CEUs and a $150 feeSame

Which version to sit this autumn

V3 still makes sense in one case: you've already worked through CS0-003 material and could test by late November. That leaves time for a second attempt, which CompTIA allows straight away, before the December 22 cutoff. A third attempt needs a 14-day wait, so a plan that depends on one is already too tight. English V3 learning products retire a month earlier, on November 22, so don't start a CertMaster subscription for V3 now.

Everyone else should prepare for V4. The materials have caught up: Mike Chapple and David Seidl's CySA+ Study Guide for CS0-004 (Sybex, fourth edition) came out in August 2026, and CompTIA's CertMaster products are already mapped to V4. Be careful with vouchers. CompTIA's terms tie each voucher to an exam series and say a retirement date overrides the expiry printed on it, so a V3 voucher held for a January exam date will simply stop working.

If you test in Japanese, Portuguese or Spanish, you have until March 23, 2027 on V3, because CompTIA lists V4 in those languages only as coming soon.

What the four domains test

V4 weights, with V3 in brackets:

  • Security Operations: 34% (33%)
  • Vulnerability Management: 26% (30%)
  • Incident Response and Management: 24% (20%)
  • Reporting and Communication: 16% (17%)

Security Operations takes a third of the exam, and objective 1.3 is the longest in the outline. It names more than 20 tools you may be asked to use in a scenario, including CyberChef, Zeek, Suricata, YARA, VirusTotal, MISP and AbuseIPDB. It also expects you to read JSON, XML, YAML and Windows EVTX files and to spot suspicious Python, PowerShell and shell commands. Six of V4's 15 objectives start with "Given a scenario", and those are the ones to practise hands-on: analyzing indicators, using tools, choosing a scan method, reading scanner output, prioritizing vulnerabilities and carrying out incident response.

The weight moves from vulnerability management toward incident response in V4. A new objective, 1.6, covers AI in security operations: its risks (hallucinations, data exposure, model poisoning, malicious prompts), AI usage policies, and uses such as log analysis and event correlation. Objective 2.3 asks you to rank vulnerabilities using the Common Vulnerability Scoring System alongside the Exploit Prediction Scoring System, and the tool list in 2.2 reaches into cloud with ScoutSuite, Prowler, Trivy and Checkov.

Reporting is the smallest domain and the easiest to underrate. Objective 4.2 lists the metrics a SOC reports, among them mean time to detect, respond and remediate, false-positive rate and phishing click rate, and the parties a communication plan has to cover, from legal to law enforcement. CompTIA doesn't publish how many performance-based items you'll get or how 750 converts to a percentage.

A study plan built around the tool list

Download the CS0-004 objectives PDF, 15 pages long, and use objectives 1.3 and 2.2 as your lab checklist. CompTIA publishes no study-hour estimate for V4. If you already work in a SOC, we'd budget about 12 weeks at eight to ten hours a week: four on Security Operations, three on vulnerability management, three on incident response, one on reporting, and a last week of timed practice.

Give at least half of each week to hands-on work:

  • Read packet captures in Wireshark and tcpdump, write a Suricata or Snort rule for what you find, and decode the odd payloads in CyberChef.
  • Scan a small lab with Nmap and OpenVAS, then rank the findings using CVSS, EPSS and asset value, as objective 2.3 does. Run Trivy against a container image you built.
  • Write an incident response playbook for one scenario, run it as a tabletop, and build the timeline and root cause analysis that objective 3.3 lists.
  • Write one executive summary and one vulnerability report for a non-technical reader. That's most of domain 4.

For the reading, choose one main source: the Chapple and Seidl guide or CompTIA's CertMaster Learn ($599). CertMaster Labs ($199) suits anyone who can't build a lab, and CertMaster Practice ($209) gives you timed questions. Keep MITRE ATT&CK open while you study, since the outline names it in both domains 1 and 3.

Renewal and what to earn next

CySA+ is valid for three years. Renewing through continuing education takes 60 continuing education units (CEUs) and a $150 fee for the cycle, paid when you upload CEUs rather than every year. Passing the latest CySA+ exam or earning SecurityX renews it with no fee. CySA+ sits above Security+ and Network+ in CompTIA's hierarchy, so keeping it current renews those as well.

Next steps:

  • GCIH for incident handling under exam conditions: GIAC lists 106 questions, four hours, a 69% pass mark and CyberLive hands-on items.
  • CISSP once you have five years in two of its eight domains. CySA+ is on ISC2's list for a one-year experience waiver.
  • SecurityX if you're moving toward security engineering and architecture.

Our view

CySA+ is one of CompTIA's more practical exams. Its objectives are built on tool output, log lines and scenarios, and the V4 tool list reads like a working SOC's. It's still a 165-minute proctored test, though, not a lab where you hunt an attacker for hours, so it shows you can read evidence more than that you can find it. At $439 it's good value for an analyst on a DoD contract or chasing postings that name it. Two years into a SOC with an employer who'll pay for GIAC, we'd pick GCIH.

Sources