CompTIA CySA+
CompTIA's security analyst exam, for people who detect, analyze and respond to threats in a SOC or vulnerability management role. Practice the work it tests: reading logs, alerts and scanner output, prioritizing vulnerabilities, running incident response and reporting to stakeholders. Every question is original and maps to CompTIA's current CS0-004 exam objectives.
What you'll study
Every section follows the official CS0-004 exam outline. Click a domain to see its sections.
Logging and operating system concepts, cloud and network architecture, IAM and data protection, then reading network, host, application, cloud and email indicators, packet and log analysis, analyst tools, threat intelligence, threat modeling and automation and AI in the SOC.
Asset inventory and scan planning, scan types and discovery, network, web app, cloud and breach attack simulation tools, then prioritizing findings with CVSS, EPSS and context, mitigation and validation, control types, risk and governance, and application and third-party risk.
The Cyber Kill Chain, Diamond Model and MITRE ATT&CK, every phase of the incident response process, plans, playbooks and roles, log correlation and alerting, triage and timelines, evidence and chain of custody, isolation and escalation, recovery and root cause analysis.
Vulnerability scan and compliance reports, risk scorecards and action plans, inhibitors to remediation, stakeholders and metrics, incident declaration and handover, executive summaries, communication plans, post-incident reports, and alert-quality, phishing and mean-time metrics.
Study, Quiz, Exam
Read the concepts, practice in short rounds, then test yourself on a mock exam with targeted feedback on where you need to focus more. Every question is original and maps to the official CS0-004 outline.
Learn the concept first
Short study cards cover each section before you answer a single question.
Attackers borrow trusted names, so judge a process by its parent, path and owner. A genuine svchost.exe runs from System32 under services.exe, and real Linux kernel workers run as root under kthreadd (PID 2). A /proc/PID/exe link ending in (deleted) means the binary was unlinked but the process still runs, and the file can often be copied out through it.
| Location | When it runs |
|---|---|
| System-wide preload file in /etc | Listed libraries load into every program first (Dynamic Linker Hijacking) |
| Run key | At each user logon, in that user's context |
| Winlogon Userinit value | Every listed program, at logon |
Ten-question rounds
Every answer explained. Score 80% and the next section unlocks.
An analyst reviews a workstation's process tree after an alert.
Which detail most strongly indicates a masquerading process?
Service Host instances are started by the Service Control Manager (services.exe) from System32, so an svchost.exe launched by explorer.exe, here running from C:\Users\Public, is a trusted name in the wrong place with the wrong parent. A -k group argument and a services.exe parent are what a genuine instance shows. explorer.exe often appears without a parent because the process that started it has already exited.
Know exactly where to focus
Timed practice exams any time, with a study plan built from your mistakes.
What to expect on the CS0-004
Made for people ready to move into a security analyst role: watching alerts, hunting threats and handling vulnerabilities. CompTIA suggests some security experience first, but there are no formal prerequisites.
Source: CySA+ Certification V4 (New Version) | CompTIA, checked October 16, 2026
Where this cert takes you
Real job titles where CySA+ skills are the day-to-day work.
- SOC Analyst (Tier 1)
- Junior Security Analyst
- Vulnerability Analyst
- Security Operations Technician
- Cybersecurity Specialist
- Incident Response Analyst
- Security Analyst
- SOC Analyst (Tier 2)
- Threat Intelligence Analyst
- Vulnerability Management Analyst
- Incident Responder
- Threat Hunter
- Senior Security Analyst
- SOC Lead
- Security Engineer
- Detection Engineer
- Incident Response Lead
- Vulnerability Management Lead
Ranges based on BLS Occupational Employment & Wage Statistics (May 2025) for Information Security Analysts: 10th percentile $75,090, median $129,180, 90th percentile $199,850. Adjusted by metro. The first role in each column is the most common entry point.
Recommended ProCourse
A good course to pair with your cert study for learning hard tech skills while you study for your cert
Cyber Security & Operations
Harden servers, hunt threats, investigate breaches. Learn nmap, tshark, auditd, and forensic analysis, then move into SOC operations, compliance frameworks, and security architecture. Defend systems that matter.
View CurriculumQuestions
Start practicing for CS0-004
Included with an opnf.sh subscription, $15/month or $120/year.
Get CertPrepCompTIA and CySA+ are trademarks or registered trademarks of CompTIA, Inc. opnf.sh is not affiliated with, sponsored by or endorsed by CompTIA. All practice questions are original and are not taken from any CompTIA exam.