CySA+ validates the skills of an analyst who can detect, analyse and respond to threats in a security operations center. This five-day preparation follows the new CS0-004 version, launched in June 2026, and its four domains, from day-to-day monitoring through to reporting to management. It combines log analysis, vulnerability prioritisation exercises, incident scenarios and exam-style practice, so you build the reasoning the exam expects as well as the knowledge behind it.
Analyse logs, alerts and indicators to spot malicious activity
Use SOC tools and techniques, including automation
Run a full vulnerability management cycle, from scanning to remediation
Apply a structured incident response process
Write reports and communicate with stakeholders
Manage time and method on the exam's longer questions
Program
Security operations (34%)
Architecture and monitoring concepts
Log, traffic and behaviour analysis
Threat intelligence and threat hunting
Automation and SOC process improvement
Vulnerability management (26%)
Scanning methods and tools
Interpreting and prioritising results
Compensating controls and remediation
Incident response and management (24%)
Frameworks and the incident lifecycle
Detection, containment, eradication, recovery
Post-incident activities
Reporting and communication (16%)
Vulnerability reporting and metrics
Communication during incidents
Lessons learned
Prerequisites
CompTIA recommends about four years in a SOC analyst or vulnerability analyst role
Security+ or equivalent knowledge is strongly advised
These recommendations are not mandatory to sit the exam
Target audience
Tier 1 and tier 2 SOC analysts looking to formalise their skills
Vulnerability analysts
Incident responders
Security administrators moving into analysis roles
The exam
The CS0-004 exam has up to 85 questions to complete in 165 minutes, with a passing score of 750 on a 100–900 scale. You take it through Pearson VUE, at a test center or online with remote proctoring (OnVUE). It is available in English, and CompTIA has announced French, Japanese, Spanish and Portuguese versions as coming soon. The previous CS0-003 version remains available in English until 22 December 2026. We recommend going straight for CS0-004: it is the newest version, it will remain on offer well after CS0-003 is withdrawn, and the credential will stay current for longer. Book your exam date early so that revision has a clear deadline.
Preparation tips
Consolidate Security+ fundamentals before the course
Practise reading logs and vulnerability scanner output
Keep a time buffer: 165 minutes go fast on long questions
Frequently asked questions (FAQ)
Should I take CS0-003 or CS0-004?
CS0-004 has been the current version since 23 June 2026. CS0-003 is withdrawn in English after 22 December 2026, so CS0-004 is the logical choice for anyone starting now.
Is CySA+ available in French?
CompTIA has announced a French version of CS0-004 as coming soon. Until then the exam is in English; our course can be taught in French or English.
Do I need Security+ before CySA+?
It is not mandatory, but CySA+ assumes you already know Security+ level concepts, so review them first if they are not fresh.
How long is the exam?
165 minutes for up to 85 questions, which leaves room for careful reading if you keep a steady pace.
Which formats do you offer?
Live online, in person in Casablanca or on-site at your organization, in French or English.