CySA+ study guide · 2026

The 4 CySA+ domains, explained

4 domains and 15 official objectives. Security Operations carries the most weight at 34%. Each guide explains what the domain covers, how its questions are framed and where candidates lose marks.

Start with Domain 1 See all domains
Questions
Maximum of 85
Time
165 minutes
Passing score
750 (scale 100–900)
Outline
CS0-004 (V4) exam objectives v2.0, launched 23 June 2026 (current)

Exam blueprint

Bar widths follow the official weights. Weight ranges are drawn at their midpoint.

  1. 1 34%
  2. 2 26%
  3. 3 24%
  4. 4 16%
  1. 1 Security Operations
  2. 2 Vulnerability Management
  3. 3 Incident Response and Management
  4. 4 Reporting and Communication

All 4 domains

15 official objectives 100–135 hrs suggested study

  1. Domain 01 34%

    Security Operations

    Security Operations is the largest CySA+ domain. It covers the analyst's core work: understanding the environment, spotting indicators of malicious activity, using the right tools to confirm them, applying threat intelligence, improving SOC processes and using AI safely.

    Inside this domain

    • Explain concepts related to system and network architecture in security operations.
    • Given a scenario, analyze indicators of potential malicious activity.
    • Given a scenario, use tools to determine malicious activity.
    • Explain threat intelligence and threat-hunting concepts.
    • and 2 more objectives

    Watch for Signed means safe

    Objectives
    6
    Questions est.
    ~29
    Study time est.
    35–45 hrs
  2. Domain 02 26%

    Vulnerability Management

    Vulnerability Management covers finding weaknesses and deciding which ones matter: planning and running the right scans, reading tool output, prioritizing with exploitability and business context, and managing risk through controls, application security and third-party oversight.

    Inside this domain

    • Given a scenario, implement the appropriate vulnerability scanning method.
    • Given a scenario, analyze output from vulnerability assessment tools.
    • Given a scenario, analyze data to prioritize and mitigate vulnerabilities.
    • Explain concepts related to control types, risks, and vulnerability management.

    Watch for Highest score wins

    Objectives
    4
    Questions est.
    ~22
    Study time est.
    25–35 hrs
  3. Domain 03 24%

    Incident Response and Management

    Incident Response and Management covers how analysts understand attacks and handle them: attack methodology frameworks, the incident response process from preparation to post-incident, and the practical techniques of triage, evidence handling, containment, restoration and root cause analysis.

    Inside this domain

    • Summarize concepts related to attack methodology frameworks.
    • Summarize the incident response process.
    • Given a scenario, implement incident response techniques.

    Watch for Release early

    Objectives
    3
    Questions est.
    ~20
    Study time est.
    25–35 hrs
  4. Domain 04 16%

    Reporting and Communication

    Reporting and Communication covers how analysts turn findings into decisions: vulnerability reports, action plans and inhibitors to remediation, and incident declaration, stakeholder communication, post-incident reporting and the metrics that show whether security operations are improving.

    Inside this domain

    • Explain the importance of vulnerability management reporting and communication.
    • Explain the importance of security operations and incident response reporting and communication.

    Watch for Raw data for leaders

    Objectives
    2
    Questions est.
    ~14
    Study time est.
    15–20 hrs

Study the heaviest domains first

Marks follow weight. This order puts the most marks behind you first, across about 100–135 hrs of study.

  1. 1 Security Operations 34% · 35–45 hrs
  2. 2 Vulnerability Management 26% · 25–35 hrs
  3. 3 Incident Response and Management 24% · 25–35 hrs
  4. 4 Reporting and Communication 16% · 15–20 hrs

Try one

Practice questionDomain 1: Security Operations

An analyst sees a user sign in from London, then 20 minutes later from Singapore. Shortly after, a new inbox rule forwards emails containing 'invoice' to an external address. What is the MOST likely activity?

One trap from every domain

The answer that looks right, and the clue that gives it away.

  • Domain 1

    Signed means safe

    Clue Look at the command-line arguments and the parent process.

  • Domain 2

    Highest score wins

    Clue The question gives exposure, asset value, EPSS or exploitation data.

  • Domain 3

    Release early

    Clue The scenario has not mentioned root cause or verification.

  • Domain 4

    Raw data for leaders

    Clue The audience is executive or board level.

Other Cybersecurity certifications

Study guides for exams that overlap with CySA+.

Practise what you read

CySA+ domains: common questions

How many domains are in the CySA+ exam?

CySA+ has 4 domains with 15 official objectives between them: Security Operations, Vulnerability Management, Incident Response and Management and Reporting and Communication.

Which CySA+ domain carries the most weight?

Security Operations is the heaviest at 34%, followed by Vulnerability Management (26%). The lightest is Reporting and Communication (16%). Weights come from CompTIA's official outline.

What is the CySA+ exam format?

Questions: Maximum of 85. Time allowed: 165 minutes. Passing score: 750 (scale 100–900).

How long should I study for CySA+?

Our planning estimate is 100–135 hrs across all domains, split by weight. It is an editorial estimate, not an official figure, so adjust it to your experience and to how you score on practice questions.

Where should I start?

Start with Security Operations, because it carries the most marks, then work down by weight. Use the checklist on each domain page to confirm you can do what the domain asks before moving on.

Which outline is this guide based on?

This guide follows CS0-004 (V4) exam objectives v2.0, launched 23 June 2026 (current), published by CompTIA. It was last reviewed in October 2026.

Domain names, weights and objectives come from CompTIA's official outline (CS0-004 (V4) exam objectives v2.0, launched 23 June 2026 (current)). Question counts and study hours are editorial planning estimates, not official figures. Last reviewed October 2026.