CySA+ CS0-004 Exam Objectives Explained: All 15 Objectives and Domain Weights
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
CySA+ CS0-004 is built on 15 objectives in four domains, and Security Operations is 34% of the exam. The exam has up to 85 questions in 165 minutes with a passing score of 750 on a scale of 100 to 900, and CompTIA recommends about four years as a SOC or vulnerability analyst. This guide lists every official objective title with a plain-English explanation, grouped by domain with the published weights, and covers the V3 retirement dates so you study the right version. The official CompTIA objectives document is the authoritative source, and the explanations here are our own wording.
CySA+ CS0-004 at a Glance
CySA+ is CompTIA's security analyst certification. The current version is V4 (CS0-004), which launched on June 23, 2026. All figures come from CompTIA's certification pages.
| Exam fact | CySA+ CS0-004 |
|---|---|
| Questions | Maximum of 85 |
| Length | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Recommended experience | About 4 years in a SOC analyst or vulnerability analyst role |
| Launched | June 23, 2026 |
CompTIA's page does not list the question types for V4 on that page, so check CompTIA's FAQ for the current mix of multiple-choice and performance-based items.
CySA+ V3 Is Retiring: Study V4
If you find older study material, check the exam code. CySA+ V3 (CS0-003) is the retiring version. According to CompTIA, English learning products for V3 retire on November 22, 2026, the English V3 exam retires on December 22, 2026, and translations retire on March 23, 2027. Study CS0-004 unless you have a V3 appointment before its retirement.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Domain Weights and Objective Counts
CySA+ CS0-004 has four domains and 15 objectives. Security Operations and Vulnerability Management together are 60% of the exam.
| Domain | Weight | Objectives |
|---|---|---|
| 1. Security Operations | 34% | 6 |
| 2. Vulnerability Management | 26% | 4 |
| 3. Incident Response and Management | 24% | 3 |
| 4. Reporting and Communication | 16% | 2 |
Domain 1: Security Operations (34%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 1.1 | Explain concepts related to system and network architecture in security operations. | How systems and networks are built, and where logging and monitoring fit in |
| 1.2 | Given a scenario, analyze indicators of potential malicious activity. | Spotting signs of compromise in logs, network traffic and host behavior |
| 1.3 | Given a scenario, use tools to determine malicious activity. | Choosing and reading the output of analysis tools to confirm or rule out an attack |
| 1.4 | Explain threat intelligence and threat-hunting concepts. | Using intelligence sources and hypothesis-driven hunts to find threats before alerts fire |
| 1.5 | Explain the importance of efficiency and process improvement in security operations. | Automation, tuning and workflow improvements that make a SOC faster and more accurate |
| 1.6 | Summarize concepts related to the use of AI in security operations. | Where AI helps analysts, and where its limits and risks matter |
Domain 2: Vulnerability Management (26%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 2.1 | Given a scenario, implement the appropriate vulnerability scanning method. | Picking scan types and settings that fit the environment |
| 2.2 | Given a scenario, analyze output from vulnerability assessment tools. | Reading scan results and separating real findings from noise |
| 2.3 | Given a scenario, analyze data to prioritize and mitigate vulnerabilities. | Ranking vulnerabilities by risk and choosing a fix or compensating control |
| 2.4 | Explain concepts related to control types, risks, and vulnerability management. | How controls, risk and vulnerability management programs fit together |
Domain 3: Incident Response and Management (24%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 3.1 | Summarize concepts related to attack methodology frameworks. | How frameworks describe attacker behavior and how analysts use them |
| 3.2 | Summarize the incident response process. | The stages of incident response from preparation through lessons learned |
| 3.3 | Given a scenario, implement incident response techniques. | Containment, eradication and recovery actions in a realistic incident |
Domain 4: Reporting and Communication (16%)
| Objective | Official title | What it means in practice |
|---|---|---|
| 4.1 | Explain the importance of vulnerability management reporting and communication. | Telling the right people about vulnerabilities in a form they can act on |
| 4.2 | Explain the importance of security operations and incident response reporting and communication. | Status updates, metrics and post-incident reports for technical and non-technical audiences |
How to Study for CySA+
CySA+ is an analyst exam, so most of it asks you to look at evidence and decide what it means. Practice with real log samples and scan output, not just definitions.
Read real logs and alerts
Practice explaining what a firewall, authentication or endpoint log entry shows, and whether it is suspicious in context.
Work through vulnerability scan results
Take sample scan output and practice ranking findings by risk, choosing a fix and writing a one-line justification.
Rehearse an incident end to end
Walk a sample incident from detection through containment and lessons learned, naming the action and the evidence at each step.
Do not skip reporting
Domain 4 is 16% of the exam. Practice writing short, clear updates for a technical audience and for management.
Plan for the long exam
At 165 minutes, pacing matters. Practice sustained scenario sets and check the clock regularly.
Where CySA+ Fits
Most people take Security+ first and CySA+ after some hands-on SOC or vulnerability experience, because CompTIA recommends about four years in the role. See our guides to which CompTIA certification to take first and the full CompTIA security path.
Studying With DD Academy
DD Academy covers CySA+ CS0-004 along with six other exams, with flashcards, practice questions and an AI tutor that explains every answer. It is free to start on iPhone and the web.
The bottom line
CySA+ is an evidence-reading exam, so practice with real logs, scan output and incident scenarios. Study V4 (CS0-004), since V3 is retiring, weight your time by domain, and check CompTIA's CySA+ page for the confirmed question types and dates before you book.
Frequently asked questions
How many questions are on the CySA+ CS0-004 exam?
CySA+ CS0-004 has a maximum of 85 questions in 165 minutes, with a passing score of 750 on a scale of 100 to 900, according to CompTIA's CySA+ V4 page.
What are the CySA+ CS0-004 domains and weights?
Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, and Reporting and Communication 16%. The exam has 15 objectives across the four domains.
When did CySA+ V4 launch?
CompTIA lists CySA+ V4 (CS0-004) as launched on June 23, 2026. The previous version, V3 (CS0-003), is retiring, with the English exam retiring on December 22, 2026.
When does CySA+ V3 (CS0-003) retire?
According to CompTIA, English learning products for V3 retire on November 22, 2026, the English V3 exam on December 22, 2026, and translations on March 23, 2027. Study V4 unless you already have a V3 appointment.
What experience does CompTIA recommend for CySA+?
About 4 years of experience in a SOC analyst or vulnerability analyst role. This is a recommendation and not a prerequisite, but it indicates that the exam expects analyst-level judgment.
Should I take Security+ or CySA+ first?
Most people take Security+ first, since it covers foundational security concepts, and take CySA+ after hands-on analyst experience. CompTIA does not require an order. See our guide to which CompTIA certification to take first.
Is there a new AI objective in CySA+ CS0-004?
Yes, objective 1.6 covers concepts related to the use of AI in security operations. It is part of Domain 1, Security Operations, which is 34% of the exam.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
