Study guide · Exam overview
The format, passing score, and four published domains of CompTIA Cybersecurity Analyst CS0-003, plus what changed on the newer CS0-004 exam.
Exam version notice: This overview follows CompTIA CySA+ exam objectives version 4.0 for CS0-003, reviewed in October 2026. CompTIA calls that series CySA+ V3. It launched on June 6, 2023. The exam allows a maximum of 85 questions in 165 minutes, and CompTIA publishes a passing score of 750 on a scale of 100 to 900. English CS0-003 retires on December 22, 2026. CS0-004 is CySA+ V4. Items tagged Extra are useful context the CS0-003 objective list does not name. Confirm the exam code, fee, and objectives with CompTIA before you register.
CompTIA CySA+ is the analyst certification for people who detect malicious activity, hunt for it, prioritize vulnerabilities, run an incident, and explain the result to someone who can act. CS0-003 checks whether you can name an indicator, pick the tool that would show it, tell a true finding from a false one, contain an attack that is still moving, and brief the right stakeholder. It assumes you already know the Security+ vocabulary. It is not a penetration-tester practical, and it does not ask you to write an exploit.
Figures below come from the CS0-003 objectives version 4.0 and CompTIA's CySA+ V3 page reviewed in October 2026.
| Specification | CS0-003 (CySA+ V3) |
|---|---|
| Level | Analyst. No prior certification is required. CompTIA recommends Network+ and Security+, or equivalent knowledge, plus a minimum of four years as an incident response analyst or SOC analyst. |
| Length of test | 165 minutes. |
| Question types | Multiple choice and performance-based questions. The stem says how many answers to choose. |
| Number of questions | Maximum of 85. |
| Passing score | 750 on a scale of 100 to 900. CompTIA does not publish the raw-score conversion. |
| Objectives | Version 4.0. Four domains. Example lists in the objectives are not exhaustive. |
| Languages | English, Japanese, Portuguese, and Spanish. English retires on December 22, 2026. The other three retire on March 23, 2027. |
| Exam price | Confirm the current voucher price with CompTIA. Regional pricing changes. |
| Validity | Three years from the pass date. Confirm renewal options with CompTIA. |
| Later version | CS0-004 (CySA+ V4) launched on June 23, 2026. A voucher applies to the exam CompTIA is offering when you book. |
Book the code on your voucher. Use this table to see what moved when V4 launched.
| Domain | CS0-003 weight | CS0-004 weight |
|---|---|---|
| Security Operations | 33% | 34% |
| Vulnerability Management | 30% | 26% |
| Incident Response and Management | 20% | 24% |
| Reporting and Communication | 17% | 16% |
Both exams use a maximum of 85 questions, 165 minutes, and a passing score of 750 on the 100 to 900 scale. The content shift is why a CS0-003 book is the wrong primary source once your voucher says CS0-004.
A certification earned on CS0-003 stays valid for three years from the pass date. It does not let you skip CS0-004 if your booking is for the newer exam. Deeper control definitions that both exams assume are on Security+.
CompTIA publishes these CS0-003 weights. The 200 practice questions use the same share.
The largest domain. Architecture, indicators, tools, hunting, and how the SOC stops repeating itself.
How you scan, how you decide the finding is real, and what you patch first.
The models, then the work of containing and learning.
The page a stakeholder can use, and the reason a fix is late.
Learn the unmarked rows first. The same map is in the core notes and flashcards.
| Pair | How to separate them |
|---|---|
| SIEM and SOAR | A SIEM correlates logs into alerts. SOAR runs the repeatable steps after the alert. SOAR does not replace the decision to contain a host. |
| SPF, DKIM, and DMARC | SPF lists the sending hosts. DKIM signs the message. DMARC says what to do when those checks fail. |
| False positive and false negative | A false positive is a finding that is not real. A false negative is a real flaw the tool missed. The miss is the dangerous one. |
| CVSS and priority | CVSS is technical severity. Priority also uses exposure, exploitability, and how much the asset matters. |
| Reflected and persistent XSS | Reflected XSS comes back in the same response. Persistent XSS is stored and hits the next visitor. |
| SSRF and CSRF | SSRF makes the server call a URL the attacker chose. CSRF makes the victim's browser submit a request they did not intend. |
| Kill chain and ATT&CK | A kill chain is a sequence of stages. ATT&CK is a matrix of tactics and techniques, not one straight line. |
| Contain and remediate | Containment stops the spread. Remediation is the fix. Mean time to respond is not mean time to remediate. |
| Legal hold and chain of custody | Legal hold means do not delete the data. Chain of custody is the log of who handled the evidence. |
| Avoid and transfer | Avoid stops the activity. Transfer shifts the impact, often to insurance. Neither one is a patch. |
| AI in the SOC Extra | CS0-004 adds an objective on AI use, risk, and governance. CS0-003 does not. Learn it when your voucher says CS0-004. |
Most items are multiple choice. Some ask you to choose two answers, and the stem says so. Performance-based items ask you to match a tool or a metric to a job, or to put containment, eradication, and recovery in order. Read FIRST, NEXT, and BEST as ordering words: the right control at the wrong step is still wrong.
CompTIA says the example lists in the objectives are not exhaustive. A question can use a technology that fits an objective even when the PDF did not print that product name. Do not expect a full malware-analysis lab.
A practical sequence if indicators, scores, and incident order still blur together.
Say what beaconing, impossible travel, a rogue device, and a new Run key look like. Then name the tool that would show each one: a SIEM, EDR, a packet capture, or a sandbox.
SPF, DKIM, and DMARC. Then impossible travel, new accounts, and an unintentional insider. A passed MFA check does not erase two continents three minutes apart.
Credentialed versus not, agent versus agentless, passive versus active. A non-credentialed scan that looks clean can be a false negative. Treat OT and SCADA as fragile.
Read attack vector, privileges, user interaction, and scope. Then ask whether the host is on the internet and what it stores. A 9.8 on a lab printer can wait behind a 7.5 on the billing API.
Prepare before the bad day. Contain what is still spreading. Preserve evidence and the chain of custody. Eradicate, recover from a known-good image, then write the lesson into the playbook.
Executives get impact and a decision. The SOC gets indicators. Detect, respond, and remediate stay three clocks. Use the four flashcard decks until you answer before the card flips. Then take original questions and return to any domain under 75 percent. The live exam gives you 165 minutes. Treat the 100 to 900 estimate as a personal trend, not a prediction.
The overview, core notes, flashcards, and practice exams are all published.
Exam format, the 750 passing score, four domain weights, and the CS0-004 retirement dates.
Reference notes for indicators, scanning, incident handling, and the reports leaders expect.
40 recall cards in four decks, plus memory notes for mail checks, CVSS, and the response clocks.
200 original questions with custom exams, explanations, and an unofficial score on the 100-900 scale.
CompTIA allows a maximum of 85 questions and 165 minutes. Questions are multiple choice and performance-based. Confirm the current details with CompTIA before you book.
CompTIA publishes a passing score of 750 on a scale of 100 to 900 for CS0-003. This site converts a practice percentage linearly onto that scale and labels the result unofficial, because CompTIA does not publish the real conversion.
Study the exam code on your voucher. CS0-003 is CySA+ V3. CompTIA launched CS0-004, CySA+ V4, on June 23, 2026. English CS0-003 retires on December 22, 2026. Japanese, Portuguese, and Spanish retire on March 23, 2027. V4 keeps four domains but changes the weights and adds AI in security operations.
Yes. CompTIA certifications are valid for three years from the date you pass. Renewal options change, so confirm the current policy with CompTIA.
No prior certification is required. CompTIA recommends Network+ and Security+, or equivalent knowledge, plus about four years as an incident response analyst or SOC analyst.
No. The practice questions on this site are original. They are not CompTIA exam items, and a practice score does not predict a result.
Useful companions while you study.
Generate strong random passwords with custom length, characters, symbols, and security options.
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Convert structured data between JSON and YAML with formatting and validation.
Calculate elapsed time, add or subtract hours and minutes, and convert time to decimal hours.
Exam versions, objectives, prices, languages, and retirement dates can change. Verify the details on the CompTIA certification page before you register.
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. CompTIA and CySA+ are trademarks of CompTIA, Inc. Certicab is not affiliated with, endorsed by, or sponsored by CompTIA.
Certi