CompTIA CySA+ (CS0-003)
Validate intermediate security analyst skills in applying behavioral analytics to networks and devices to prevent, detect, and combat cybersecurity threats through continuous security monitoring and incident response.
Official Exam Specification & Quick Facts
Question Difficulty Breakdown
Exam Guidelines & Simulation Rules
Frequently Asked Questions (FAQ)
CompTIA Cybersecurity Analyst (CySA+) is an intermediate, high-stakes workforce certification validating threat detection, behavioral analytics, vulnerability management, and incident response.
The exam consists of up to 85 multiple-choice and hands-on performance-based questions (PBQs) to be completed within 165 minutes.
The passing scaled score is 750 on a scale of 100 to 900 (approximately 81%).
Domains include: (1) Security Operations (33%), (2) Vulnerability Management (20%), (3) Incident Response and Management (30%), and (4) Reporting and Communication (17%).
Behavioral analytics (UEBA) establishes mathematical baselines of normal user and network behavior, triggering alerts when deviations occur (e.g. off-hours logins, unusual bulk data transfers) regardless of whether a signature exists.
Threat hunting is proactive hypothesis-driven investigation rather than passive alert monitoring. Analysts formulate hypotheses based on threat intelligence (MITRE ATT&CK) and search SIEM/EDR telemetry for signs of undetected adversaries.
Common Vulnerability Scoring System (CVSS v3.1) evaluates Base metrics (Attack Vector, Complexity, Privileges Required, Impact), Temporal metrics (Exploit Code Maturity), and Environmental metrics to prioritize remediation.
IoCs are forensic artifacts proving an intrusion already occurred (file hashes, known C2 IPs). IoAs focus on real-time behavior and intent (privilege escalation patterns, lateral movement) regardless of the specific malware used.
Security Orchestration, Automation, and Response (SOAR) automates repetitive triage tasks (enriching IP reputation, sandboxing email attachments, quarantining infected endpoints) via pre-scripted playbooks.
The Diamond Model maps malicious events across four core interconnected nodes: Adversary, Capability, Infrastructure, and Victim, helping analysts understand campaign relationships and pivot investigations.
Documenting every individual who collected, accessed, transferred, and analyzed evidence, accompanied by cryptographic hashes verifying the image was not altered.
Tier II/III SOC analysts, incident responders, threat intelligence analysts, vulnerability management specialists, and cybersecurity consultants.