Free study guide

CompTIA CySA+ CS0-004 Study Guide

CompTIA Cybersecurity Analyst (CySA+) CS0-004

CompTIA Cybersecurity Analyst (CySA+) CS0-004 is an intermediate exam for security analysts. It covers security operations, vulnerability management, incident response and management, and reporting and communication. It suits people who monitor, detect and respond to threats.

  • Exam code CS0-004
  • Intermediate level
  • 4 exam domains

This guide is free, with no sign-up. It explains every CompTIA CySA+ CS0-004 exam topic in plain English, one chapter at a time. Read them in order or jump straight to the topic you need.

  • 4chapters
  • 24topics
  • 11diagrams and exhibits
  • 2 h 11 minfast track
Start with Security Operations
  • Every topic follows the same simple pattern: what it is, how it works, common mistakes
  • Diagrams and real command output where a picture explains it best
  • Exam tips and worked subnetting and IPv6 practice, with answers

How the exam is weighted

Each domain is worth this share of the exam, so spend your study time in proportion. Select a domain to open its chapter.

Chapters

Open a chapter to see its topics and how long each takes.

1Security Operations10 topics · 54 min fast trackArchitecture, logs, indicators, detection tools, threat intelligence, hunting, automation and AI.
  1. 1Security Architecture Concepts7 min
  2. 2Identity and Logging Practices4 min
  3. 3Indicators of Malicious Activity6 min
  4. 4SIEM and EDR Tools5 min
  5. 5Packet, File and Email Analysis6 min
  6. 6Threat Intelligence Concepts6 min
  7. 7Threat Hunting Methods4 min
  8. 8Automation and Process Improvement5 min
  9. 9AI in Security Operations6 min
  10. 10Encryption Techniques5 min
Read the chapter overview →
2Vulnerability Management5 topics · 30 min fast trackScanning, reading results, CVSS prioritisation, remediation, control types, risk and compliance.
  1. 1Vulnerability Scanning Methods6 min
  2. 2Interpreting Scan Results7 min
  3. 3CVSS and Risk Based Prioritisation5 min
  4. 4Mitigation and Remediation5 min
  5. 5Controls, Risk and Compliance7 min
Read the chapter overview →
3Incident Response and Management6 topics · 30 min fast trackAttack frameworks, response phases, triage and escalation, evidence handling and root cause analysis.
  1. 1MITRE ATT&CK Framework5 min
  2. 2Kill Chain and Diamond Model5 min
  3. 3The Incident Response Process5 min
  4. 4Triage and Escalation5 min
  5. 5Evidence Handling and Forensics5 min
  6. 6Remediation and Root Cause Analysis5 min
Read the chapter overview →
4Reporting and Communication3 topics · 17 min fast trackVulnerability reports, incident documentation, post incident reviews and security metrics.
  1. 1Vulnerability Reporting and Communication5 min
  2. 2Incident Reporting and Post Incident Review6 min
  3. 3Security Operations Metrics6 min
Read the chapter overview →

Ready for more practice?

The full CompTIA CySA+ CS0-004 question bank has 654 questions, with timed practice exams and an explanation for every answer.

SubscribeTry Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.