CySA+

The exam has a maximum of 85 questions, and you have 165 minutes to complete it. That time does not include check-in at the testing center, so plan to arrive early. Performance-based items at the start can consume more time than multiple-choice items, so budget your minutes deliberately.

The exam includes multiple-choice questions (both single- and multiple-response), drag-and-drop activities, and performance-based questions. PBQs test problem-solving in a simulated environment and most appear near the beginning of the exam. Note that a clock is not visible while you work on those items, so track your own pace.

The passing score is 750 on a scale of 100–900. Because it is a scaled score rather than a raw percentage, you cannot simply count correct answers; aim for comfortable margin across all four domains rather than scraping by on the heavily weighted ones alone.

V4 (CS0-004) is the current version. The English-language V3 (CS0-003) exam remains available for a transition period and is scheduled to retire in December 2026. If you are starting fresh, prepare against the V4 objectives; only choose V3 if your study timeline and materials are already built around it.

It is an intermediate certification, not an entry-level one. CompTIA recommends approximately four years of hands-on experience in a SOC analyst (Level 2) or vulnerability analyst role, and describes the target audience as having three to four years of information security or related experience, or equivalent training. Foundational security knowledge helps considerably.

Four domains: Security Operations (34%), Vulnerability Management (26%), Incident Response (24%), and Reporting and Communication (16%). Security Operations is the heaviest, so monitoring, threat detection, threat hunting, and tooling deserve the largest share of your study time, but do not neglect reporting and communication.

Start with structured instruction mapped to the exam objectives, then move into hands-on labs before drilling practice questions. Applied work matters most because PBQs simulate real tooling. Finish with practice exams to expose weak domains, then loop back into labs for those areas rather than rereading material you already know.

CompTIA sets its own retake policy, including any required waiting period between attempts, and terms are revised periodically. Confirm the current policy on CompTIA's site before rebooking. Use your score report to identify the weakest domains and rebuild hands-on skills there before your next attempt rather than immediately rescheduling.

Running out of time on early performance-based questions, weak hands-on fluency with log and monitoring data, and memorizing product names instead of the underlying methodology. Candidates who can interpret scan results, trace an indicator of compromise across sources, and explain remediation decisions tend to handle both multiple-choice and simulated items well.