CompTIA CySA+ CS0-004 study plan
A good CompTIA CySA+ CS0-004 study plan has four phases: work through the four official domains starting with security operations, train yourself to read the tool output and logs the questions are built on, give the new AI objective and the reporting domain their own pass, then rehearse with full-length timed mocks until you clear the pass mark with margin. CySA+ is an analyst exam. Where Security+ asks which control fits a situation, CySA+ shows you an alert, a packet capture or a scan report and asks what it means and what to do next, so practice with real-looking evidence should start in the first week.
Know which version you are sitting
Prepare for CS0-004 (V4) unless you have already booked the older exam. CompTIA launched V4 on 23 June 2026, and the English CS0-003 (V3) exam retires on 22 December 2026, after which V4 is the only English version. This plan, our lessons and our questions follow the V4 objectives.
V4 adds a dedicated objective on AI in security operations and gives more attention to risk-based vulnerability prioritisation, including EPSS alongside CVSS. Study guides written for V3 cover most of the field, but not those parts, and they group the material differently.
Phase 1 — Orient (a day or two)
Read the official CS0-004 objectives end to end before anything else. They name the tools, file formats and frameworks the exam can show you, from Wireshark and Nmap to CVSS and the Diamond Model, and that list is your reading list. Nothing outside it should appear.
Then answer a short practice session cold. If you came straight from Security+, expect the vocabulary to feel familiar and the questions to feel harder: they ask you to interpret evidence rather than recognise a definition. The result sets the order of the next phase.
Phase 2 — Study the four domains (the bulk of the plan)
Start with security operations, the largest and broadest domain, and pair every lesson with a practice session on the same topic the same day. Read the explanation for every option, including the ones you rejected. Many CySA+ distractors are a correct action taken at the wrong moment, such as eradicating before containing or patching before validating that a finding is real.
- Security operations: logging and system architecture, indicators of malicious activity on networks, hosts, applications, cloud and identities, the analysis tools, threat intelligence and hunting, process improvement and automation, and AI in the SOC.
- Vulnerability management: choosing and planning scans, reading the output of assessment tools, prioritising and mitigating findings, and the control, risk and application-security concepts around them.
- Incident response and management: the Cyber Kill Chain, the Diamond Model and MITRE ATT&CK, the response process from preparation to post-incident, and hands-on techniques such as triage, evidence handling, containment and root cause analysis.
- Reporting and communication: vulnerability reports, scorecards and action plans, inhibitors to remediation, incident declaration and escalation, post-incident reports and SOC metrics.
Phase 3 — Learn to read the evidence (a week or so)
Spend a dedicated block on the artefacts questions are built around: Nmap and vulnerability-scanner output, SIEM log lines, packet captures, email headers, PowerShell and shell one-liners, and JSON or EVTX records. For each, practise answering three things in order: what happened, how sure you can be, and what the next step is. That is the shape of most analysis questions.
Do this hands-on if you can. Install Wireshark and capture your own traffic, run Nmap against a lab machine, and open a CVSS calculator to see how each metric moves the score. An afternoon with the tools makes their output far quicker to read under time pressure than any amount of description.
Phase 4 — Close the gaps, then rehearse
Give two areas their own pass, because experienced analysts tend to skip them. The AI objective is new in V4 and covers risks such as hallucination, data exposure, model poisoning and malicious prompts, the governance around AI use, and its use cases in investigation and automation. The reporting and communication domain is the smallest, but its questions on who to notify, what goes in an executive summary and which metric answers which question are precise and quick to learn.
Then sit full-length timed mocks under real conditions. The exam includes performance-based questions, interactive tasks such as working through SIEM alerts or prioritising a list of vulnerabilities, which take longer than multiple-choice items. Practise flagging a task that stalls you, answering the quick items, and coming back. Between mocks, rebuild sessions from your incorrect and flagged questions, and use the cheat sheet for the final review.
Signals you are ready
Book the exam when all of these are true:
- Consecutive full-length timed mocks clear the pass mark with room to spare.
- No domain clearly trails the others in your per-domain results.
- Shown a scan result, you can say whether it is likely a true or false positive and how you would validate it.
- You can put the incident response phases in order and say which one a given action belongs to.
- You can explain when EPSS changes a priority that CVSS alone would set.
Plan your prep
Questions, answered
Sources
Exam facts in this guide come from the vendor's published exam guide. Vendors revise these — check the source for the current version before you book.