Back to certifications
CompTIA certification
CompTIA CySA+
Detect, analyze, and respond to cybersecurity threats.CompTIA CySA+ validates your ability to detect, analyze, and respond to cybersecurity threats in today's security environments. For the most up-to-date skills and content, choose CySA+ V4 (New Version). CySA+ V3 (Retiring Version) remains available, with English learning products retiring November 22, 2026, the English exam retiring December 22, 2026, and translations retiring March 23, 2027.
Exam version: V4
Target roleSecurity analyst
Choose your
exam
CompTIA Cybersecurity Analyst (CySA+) is a cybersecurity certification that validates your ability to detect, analyze, and respond to threats in security operations and vulnerability management roles. It focuses on incident detection, response, and continuous monitoring in modern environments, while managing vulnerabilities and effectively communicating critical risks.
Skills you'll
learn
Identify and investigate suspicious activity across networks, endpoints, and cloud environments to uncover potential security threats.
Monitor and analyze data using industry-standard tools such as SIEM and EDR platforms.
Identify, prioritize, and mitigate vulnerabilities using risk-based approaches.
Investigate and respond to security incidents using structured processes and real-world techniques.
Clearly communicate security findings and risks to stakeholders through reports and dashboards.
Apply security practices across cloud and hybrid environments while supporting efficient and effective operations.
Exam
details
Exam versionV4
Exam series codeCS0-004
Launch dateJune 23, 2026
Number of questionsMaximum of 85 questions
Duration165 minutes
Passing score750 (on a scale of 100–900)
LanguagesEnglish, with French, Japanese, Spanish, and Portuguese coming soon
Recommended experienceAbout 4 years in a SOC analyst or vulnerability analyst role
Exam
objectives
1
Security operations
34%- Explain system and network architecture concepts in security operations: security architecture components, identity concepts, and logging practices that support secure environments.
- Analyze indicators of potential malicious activity: suspicious activity across networks, endpoints, cloud, and identity systems.
- Use tools to determine malicious activity: SIEM, EDR, packet analysis tools, and threat intelligence platforms.
- Explain threat intelligence and threat-hunting concepts: frameworks, data sources, and methods used to identify and investigate threats.
- Describe efficiency and process improvement in security operations: automation, workflows, and processes used to improve operational efficiency.
- Summarize concepts related to the use of AI in security operations: use cases, risks, and governance considerations.
2
Vulnerability management
26%- Implement the appropriate vulnerability scanning method: tools and techniques used to identify vulnerabilities across systems, networks, and applications.
- Analyze output from vulnerability assessment tools: vulnerabilities, findings, and security gaps identified through scan results.
- Prioritize and mitigate vulnerabilities: risk-based approaches using scoring systems, threat intelligence, and business context.
- Explain concepts related to control types, risks, and vulnerability management: controls, policies, and compliance practices used to manage risk.
3
Incident response and management
24%- Summarize concepts related to attack methodology frameworks: models such as MITRE ATT&CK and the Cyber Kill Chain.
- Outline the incident response process: phases including preparation, detection, analysis, containment, eradication, and recovery.
- Implement incident response techniques: triage, evidence handling, escalation, remediation, and root cause identification.
4
Reporting and communication
16%- Explain vulnerability management reporting and communication: reports, dashboards, and communication activities used to present findings and support escalation during security events.
- Describe security operations, incident response reporting, and communication: incident documentation, post-incident reviews, and metrics such as detection time, response time, and remediation effectiveness.
Exam information is published by CompTIA and may change. Contact us for the current exam version and available sessions.
Take CompTIA CySA+ at NEXERA Institute
Training and certification center in Sfax: professional courses, Certiport and VTest exams, and a coworking space.