Use the objectives for your booked CySA+ version to identify gaps in analysis, vulnerability management, response and reporting. This guide explains the version transition and simulation format, then gives you a complete original prioritization task.
What the CySA+ credential validates
CySA+ certifies that you can detect, analyze, and respond to threats in security operations and vulnerability management roles.
CompTIA describes the Cybersecurity Analyst certification as validating your ability to detect, analyze, and respond to threats, with emphasis on incident detection, response, and continuous monitoring alongside vulnerability management and risk communication.
In practice this is an analyst-level credential rather than an entry one: CompTIA frames it around skills such as investigating suspicious activity across networks, endpoints, and cloud, working with SIEM and EDR platforms, prioritizing vulnerabilities, and reporting findings to stakeholders.
Which version applies: V4 versus retiring V3
V4 (CS0-004) is current; V3 (CS0-003) remains available before its retirement deadlines. Choose with your language, preparation and booking date in mind.
The current version is V4, exam series code CS0-004, which launched on June 23, 2026. CompTIA's certification hub marks V4 as the new version and V3 as the retiring one.
V3 English remains available until December 22, 2026; Japanese, Portuguese and Spanish versions retire March 23, 2027. V4 English is available, with French, Japanese, Spanish and Portuguese listed as coming soon. Confirm availability if you need a translation.
The two versions have different domain weights, so do not mix them when planning. V3 weights are 33/30/20/17 across Security Operations, Vulnerability Management, Incident Response Management, and Reporting and Communication; V4 weights are 34/26/24/16 and include newer topics such as AI in security operations.
Before switching versions, confirm voucher compatibility with CompTIA. Keep accurate older explanations where they match your booked objectives, and identify the topics your materials do not cover.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CySA+ Certification V3 (Retiring Version) | CompTIA — Official V3 page, retirement dates and V3 weights; Cybersecurity Analyst+ (CySA+) Certification | CompTIA — Certification hub page, version status overview
Exam format, timing, and performance-based questions
CS0-004 combines multiple-choice and simulation performance-based questions. A simulation approximates tools or an environment and can have restricted functionality.
CompTIA lists CySA+ among exams using simulation PBQs. You can skip a simulation and return later, with work saved. Reset clears only that question. The no-return rule for virtual PBQs on other exams should not be applied to CySA+ simulations.
Multiple valid solution paths may be recognized and partial credit may be offered; scoring details are confidential. Prepare using legitimate samples or labs rather than relying on a claimed number of PBQs or points per item.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; Performance-Based Questions Overview | CompTIA IT Certifications — PBQ formats, simulation list including CySA+, skip/reset rules; Performance-Based Questions FAQs | CompTIA Blog — PBQ FAQ, partial credit and multiple valid paths; CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0) — Training-site-hosted copy of the official objectives PDF; test details, domain weights, subtopics, brain-dump policy
Passing score and retake rules
The passing standard is scaled, so it cannot be converted into a raw percentage or a required number correct.
After a first failed attempt there is no required wait before a second. Before a third or later attempt, wait at least 14 calendar days from the date of your last attempt.
The policy requires payment per attempt. Some bundles include a retake under their own terms; check your voucher. Once you have passed and achieved the certification, retaking the same code requires CompTIA's prior consent.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods, per-attempt payment, post-certification retake rule
The four domains and their weights
Security Operations carries the most weight at 34%, followed by Vulnerability Management (26%), Incident Response and Management (24%), and Reporting and Communication (16%).
The full objectives describe the testing areas and state that the examples are not exhaustive. Use the weights alongside your own gaps. The CompTIA-authored PDF linked here is a training-site-hosted copy, corroborated by the current issuer page.
| Domain | Weight | Focus areas per the objectives summary |
|---|---|---|
| 1.0 Security Operations | 34% | System and network architecture, identity, and logging; analyzing indicators of malicious activity; SIEM, EDR, and packet analysis tools; threat intelligence and hunting; automation and process improvement; AI use cases, risks, and governance |
| 2.0 Vulnerability Management | 26% | Choosing scanning methods; analyzing assessment tool output; prioritizing and mitigating with scoring systems, threat intelligence, and business context; control types and risk concepts |
| 3.0 Incident Response and Management | 24% | Attack methodology frameworks such as MITRE ATT&CK and the Cyber Kill Chain; the response process from preparation to post-incident; triage, evidence handling, escalation, and remediation |
| 4.0 Reporting and Communication | 16% | Vulnerability reports and dashboards; incident documentation, escalation, and post-incident reviews; metrics such as detection, response, and remediation times |
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0) — Training-site-hosted copy of the official objectives PDF; test details, domain weights, subtopics, brain-dump policy
Worked practice: rank findings using a stated policy
Prioritization depends on the criteria you are given. This original exercise supplies a fictional policy and all three findings.
Objective 2.3 includes exploitation, asset value, impact and scoring methods. The exercise applies its own simplified policy; it does not prescribe a universal operational priority rule.
Practice drill
Original exercise: a fictional policy assigns priority 1 to confirmed active exploitation, priority 2 to internet-facing findings without confirmed active exploitation, and priority 3 to everything else. Higher supplied severity breaks ties within one priority. D: severity 8.6, internal test server, no confirmed active exploitation. E: severity 7.9, internet-facing application, confirmed active exploitation. F: severity 9.1, internet-facing application, no confirmed active exploitation. Order D, E and F and explain each position.
Show answer
E, then F, then D.
E is priority 1 because active exploitation is confirmed. F is priority 2 because it is internet-facing without confirmed active exploitation. D falls into priority 3 under the remaining rule. Severity only breaks ties within a priority, so it does not change this order. No confirmed exploitation does not prove that exploitation is absent; the exercise classifies the supplied evidence under its stated policy.
Recommended experience and how to prepare
CompTIA recommends about four years in a SOC analyst or vulnerability analyst role. Use the objectives to build a plan around your actual gaps.
The experience figure is recommended preparation, not a mandatory four-year admission requirement. The tasks below are optional ways to practise the stated objectives.
- Security Operations: interpret legitimate sample logs and explain which observations support your conclusion; review AI use, risks and governance.
- Vulnerability Management: compare scan methods and supplied tool output, then justify priorities using the given context.
- Incident Response: review frameworks, process and evidence-handling topics and apply them to clearly specified practice scenarios.
- Reporting and Communication: write a concise handover separating observed facts, uncertainty and the next decision needed.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0) — Training-site-hosted copy of the official objectives PDF; test details, domain weights, subtopics, brain-dump policy
Preparation mistakes to avoid
Keep your preparation tied to the right objectives and review the reasoning behind your practice answers.
- Using V3 weights for a V4 booking or assuming older material covers all current topics.
- Treating the scaled score or a practice percentage as a guaranteed exam result.
- Preparing for simulations only with recall questions; practise completing a task and checking its result.
- Interpreting a difficult PBQ as proof of your final result. Scoring details are confidential.
- Using unauthorized exam content. CompTIA warns that brain dumps can lead to certification revocation and suspension.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CySA+ Certification V3 (Retiring Version) | CompTIA — Official V3 page, retirement dates and V3 weights; Performance-Based Questions Overview | CompTIA IT Certifications — PBQ formats, simulation list including CySA+, skip/reset rules; Performance-Based Questions FAQs | CompTIA Blog — PBQ FAQ, partial credit and multiple valid paths; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods, per-attempt payment, post-certification retake rule; CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0) — Training-site-hosted copy of the official objectives PDF; test details, domain weights, subtopics, brain-dump policy
Final checklist before you book
Confirm the booked version and logistics, and use practice errors to find remaining gaps.
- Confirm your exam code, language availability and date before the relevant retirement deadline.
- Map weak topics against the objectives for that version.
- Practise simulations, evidence interpretation and concise reporting.
- Know the skip, return and reset controls and plan time for both question formats.
- Check the current regional price, voucher terms, delivery and identification requirements with CompTIA.
Sources: CySA+ Certification V4 (New Version) | CompTIA — Official certification page, V4 exam details and objectives summary; CySA+ Certification V3 (Retiring Version) | CompTIA — Official V3 page, retirement dates and V3 weights; Performance-Based Questions Overview | CompTIA IT Certifications — PBQ formats, simulation list including CySA+, skip/reset rules; Performance-Based Questions FAQs | CompTIA Blog — PBQ FAQ, partial credit and multiple valid paths; CompTIA Certification Retake Policy | CompTIA IT Certifications — Retake waiting periods, per-attempt payment, post-certification retake rule; CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0) — Training-site-hosted copy of the official objectives PDF; test details, domain weights, subtopics, brain-dump policy
Sources
Facts checked September 14, 2026:
- CySA+ Certification V4 (New Version) | CompTIA
- CySA+ Certification V3 (Retiring Version) | CompTIA
- Cybersecurity Analyst+ (CySA+) Certification | CompTIA
- Performance-Based Questions Overview | CompTIA IT Certifications
- Performance-Based Questions FAQs | CompTIA Blog
- CompTIA Certification Retake Policy | CompTIA IT Certifications
- CompTIA CySA+ CS0-004 Exam Objectives (Version 2.0)