CySA+ study guide
CySA+ · Work through your exam, one topic at a time.
CompTIA Cybersecurity Analyst (CySA+) is an intermediate-level, vendor-neutral certification that validates the practical skills needed to detect, analyze, and respond to security threats in a security operations center. It sits on the CompTIA Cybersecurity Career Pathway between Security+ and SecurityX, and is aimed at analysts with roughly four years of hands-on experience in a SOC analyst (Level 2) or vulnerability analyst role, or three to four years of related information security experience or equivalent training. Typical job roles include security analyst, SOC analyst, vulnerability analyst, threat intelligence analyst, and incident responder. The current exam, V4 (CS0-004), is organized into four domains: Security Operations (34%), Vulnerability Management (26%), Incident Response (24%), and Reporting and Communication (16%), with added emphasis on cloud environments, AI-assisted detection, zero trust, and risk-based vulnerability prioritization. The CySA+ study guide has 4 sections and about 1,518 words.
01Security Operations
Security Operations questions on the CySA+ exam test whether you can say what a given control actually does , not whether you recognize a product name. Start with the detection stack: host-based telemetry (HIDS/EDR agents collecting process, file-integrity, registry, and command-line data) versus network-based telemetry (NIDS/NIPS signatures, flow analysis, full packet capture).
359 words, about 2 min02Vulnerability Management
Vulnerability management items are mostly about scoping and interpretation: what the tool actually measured, and what the number actually means. Asset inventory and attack-surface mapping come before scanning - you cannot claim coverage for hosts you never enumerated.
366 words, about 2 min03Incident Response
The incident response domain rewards knowing the process order and what evidence you may destroy at each step. The canonical lifecycle: Preparation → Detection/Identification → Containment → Eradication → Recovery → Post-incident activity (lessons learned).
392 words, about 2 min04Reporting and Communication
This domain tests whether you can translate technical findings for three audiences: executives (risk, cost, business impact), operations (what to fix and in what order), and legal/regulators (obligations and deadlines). The most common error is audience mismatch - a forty-page packet-capture analysis is not an executive summary, and a one-line "we patched it" is not a compliance record.
401 words, about 2 min