CompTIA CySA+ (CS0-004): What the Exam Actually Covers, What It Costs, and Whether You're Ready

What CS0-004 Exam Actually Certifies

CySA+ certifies that you can do the job of a security operations center analyst, not just describe one in an interview. CompTIA built the exam around four domains — Security Operations, Vulnerability Management, Incident Response and Management, and Reporting and Communication — and leans on performance-based questions to test whether you can read a SIEM alert, triage it, and decide what happens next, rather than recite a definition of "false positive."

Version 4 (CS0-004) launched on June 23, 2026, replacing CS0-003. The update isn't cosmetic. CompTIA added a dedicated block on AI in security operations — how SOC teams are using AI-assisted detection, what governance and risk questions come with it — plus deeper coverage of Zero Trust Network Access, SASE, and cloud-native monitoring. Vulnerability management now leans harder on EPSS-based prioritization and software supply chain risk (SBOM included), reflecting how vulnerability teams actually triage the flood of CVEs they get every week. If you were studying from CS0-003 materials, the skeleton is familiar but the content underneath has moved.

Who CS0-004 Exam Is For (and Who It's Not For)

CompTIA pitches CySA+ at people who already have a security job, or close to it: SOC analysts, vulnerability analysts, incident responders, threat intelligence analysts. There's no enforced prerequisite, but CompTIA's own guidance is blunt about the recommended path — Network+, then Security+, then CySA+ — and recommends roughly four years of hands-on experience before sitting the exam.

That matters more here than on most CompTIA exams. The performance-based questions assume you've actually worked with SIEM output, packet captures, and vulnerability scan results before, not just read about them. Someone fresh off Security+ with no operational experience is likely to find the scenario questions disorienting, even with strong theoretical prep. This is not the exam to take as a first cybersecurity credential.

Exam Format and Structure

You get 165 minutes for a maximum of 85 questions — a mix of multiple choice and performance-based items. That's roughly two minutes per question on average, but the performance-based ones (analyzing a log excerpt, prioritizing a vulnerability list, walking through an incident response phase) eat far more time than a straight multiple-choice item, so budgeting matters. CompTIA doesn't publish the exact split between question types or how many PBQs appear on a given form, and any site claiming a precise count is guessing.

The exam is scored on a scale of 100 to 900, and you need 750 to pass. CompTIA doesn't publish a percentage-correct equivalent because item difficulty is weighted, so don't treat 750/900 as "83%" — it isn't calculated that way.

Domains and Weightings

Security Operations is both the largest domain and the most changed from CS0-003. It covers security architecture and identity concepts, indicators of malicious activity across networks, endpoints, cloud, and identity systems, SIEM/EDR/threat intelligence tooling, threat-hunting concepts, and — new in V4 — a standalone objective on AI use cases and risk in the SOC. Vulnerability Management covers scanning methodology, interpreting scan output, and risk-based prioritization (EPSS scoring shows up here). Incident Response leans on attack frameworks like MITRE ATT&CK and the full incident lifecycle from preparation through recovery. Reporting and Communication is the smallest domain by weight but not by importance — it's where CompTIA tests whether you can turn a vulnerability scan or an incident timeline into something a stakeholder who isn't in security can act on.

Cost Breakdown

CompTIA's own published retail price for a single CS0-004 exam voucher is $425 USD. That price applies to both in-person Pearson VUE testing and OnVUE online proctoring — there's no separate online surcharge. Retake attempts require purchasing a new voucher unless you bought a bundle that includes Retake Assurance, which CompTIA and its training partners sell as an add-on to cover a second attempt.

Third-party resellers and training partners advertise vouchers at various discounted prices below $425, sometimes bundled with CertMaster Learn, Practice, or Labs. Those bundle prices vary by vendor and aren't something CompTIA controls directly, so treat $425 as the baseline and anything lower as a negotiated or promotional rate.

Prerequisites and Eligibility

There's no hard prerequisite CompTIA enforces at registration — anyone can book the exam. What CompTIA does publish is a recommendation: CompTIA Network+ and Security+ (or equivalent knowledge), plus about four years of hands-on experience as an incident response analyst or SOC analyst. Earning CySA+ also automatically renews Security+ under CompTIA's Continuing Education program, since CySA+ sits higher in the Cybersecurity Career Pathway.

How the Exam Is Scored and What Passing Requires

Pass/fail, scored 100–900, with 750 as the cutoff. CompTIA uses a weighted scoring model rather than raw percentage correct, so harder or more heavily-tested objectives count for more. Results for the multiple-choice portion are typically available immediately at the test center; performance-based question scoring can take longer to finalize, which is why some candidates see a short delay before their official score report posts.

Renewal and Continuing Education

CySA+ is valid for three years from the date you pass. Renewal runs through CompTIA's Continuing Education (CE) program — you don't have to retake the exam from scratch. Qualifying paths include earning CE credits through CompTIA's own CertMaster CE content, earning a higher-level CompTIA certification, earning a qualifying non-CompTIA industry certification, or simply passing the current version of the exam again. CompTIA also accepts a mix of smaller activities — published articles, additional training, qualifying work experience — that add up to the required CEU total, so renewal doesn't have to mean one big exam-day event three years from now.

How CS0-004 Exam Compares to a Close Alternative: GIAC GCIH

The most natural head-to-head comparison for CySA+ isn't another CompTIA exam — it's GIAC's Certified Incident Handler (GCIH), which SANS built specifically around detecting, responding to, and resolving security incidents. The two overlap heavily on incident response content, but they diverge everywhere else. GCIH runs around $949–$979 for a standalone attempt (SANS training bundles routinely push that past $9,000), against CySA+'s $425. GCIH's exam window runs roughly four hours, well beyond CySA+'s 165 minutes, and GIAC requires renewal every four years via CPE credits rather than CompTIA's three-year CE cycle.

The practical difference is scope. GCIH goes deep on incident handling and attacker tooling specifically. CySA+ spreads its coverage across security operations, vulnerability management, incident response, and reporting — a broader SOC-analyst skill set rather than an incident-handling specialization. Candidates whose employer is funding a SANS course and pushing incident response as a career track tend to land on GCIH; candidates building general SOC analyst credentials on their own budget tend to start with CySA+.

 Preparation Timeline

CompTIA's own estimate is 30–55 hours of study for someone who already meets the recommended experience bar, with a tighter 30–40 hour range cited elsewhere on their site. That estimate assumes you're not learning networking or basic security concepts from scratch — if Security+ material still feels shaky, budget significantly more time before attempting CySA+, or address that gap first. Given how new CS0-004 is, expect fewer mature third-party practice resources in the first several months after launch than you'd find for a mature exam version; CompTIA's own CertMaster Practice will likely be the most current option early on.