If you're getting started with the CompTIA CySA+ CS0-003 exam, you're probably coming from Security+ or a few years in a SOC and want a credential that proves you can actually analyse threats, not just define them. CySA+ is CompTIA's intermediate blue team certification. It tests whether you can read logs, prioritise vulnerabilities, run an incident and explain what happened to people who don't speak security. This guide covers what's on the exam, which concepts matter most, where people lose marks, and a realistic study plan.
Exam Overview
| Detail | CS0-003 |
|---|---|
| Full name | CompTIA Cybersecurity Analyst (CySA+) |
| Questions | Up to 85 (multiple choice and performance-based) |
| Time limit | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Recommended experience | Around 4 years hands-on security, Security+ or equivalent |
| Validity | 3 years, renewed through CompTIA CE |
| DoD 8140 | Approved |
The performance-based questions (PBQs) are the big difference from Security+. You'll get simulated log reviews, scan output to interpret and remediation choices to make. They take longer than multiple choice, so plan your time around them.
Exam Domains
| Domain | Weight |
|---|---|
| Security Operations | 33% |
| Vulnerability Management | 30% |
| Incident Response and Management | 20% |
| Reporting and Communication | 17% |
Security Operations and Vulnerability Management together make up 63% of the exam. If you're short on time, that's where your hours should go.
Core Concepts to Master
Log Analysis and SIEM
You need to be comfortable reading raw output: Windows event logs, Linux auth logs, firewall entries, web server logs and DNS queries. Know what a brute force attempt, a pass-the-hash attack and a beaconing pattern look like in practice. Understand how a SIEM correlates events, what SOAR adds on top, and why tuning matters when an analyst is drowning in false positives.
Threat Intelligence and Threat Hunting
Learn the difference between strategic, operational and tactical intelligence, and know common sources like ISACs, open source feeds and commercial providers. MITRE ATT&CK is central here. You should be able to map an observed behaviour to a tactic and technique, and understand how the Diamond Model and the Cyber Kill Chain frame an intrusion. Threat hunting questions usually ask you to form a hypothesis and pick the data source that would confirm it.
Endpoint and Network Detection
Expect questions on EDR, XDR, packet capture and IDS/IPS signatures. Know when to reach for Wireshark or tcpdump, what NetFlow can and can't tell you, and how to spot suspicious processes, persistence mechanisms and unusual outbound connections. Basic scripting awareness helps too. You won't write code, but you might need to read a short PowerShell, Python or Bash snippet and say what it does.
Vulnerability Scanning and Prioritisation
This is the heart of the second domain. Understand credentialed versus non-credentialed scans, agent versus agentless, and active versus passive. Know how to read a scan report and separate true findings from false positives. Prioritisation is the part people underestimate. CVSS gives you severity, but the exam expects you to weigh it against exploitability (EPSS), whether it's on the CISA KEV list, asset criticality and compensating controls.
Remediation and Mitigation
Patching isn't always the answer. You'll see scenarios where a legacy system can't be patched, a vendor fix isn't available or a change window is weeks away. Know your options: segmentation, configuration hardening, virtual patching with a WAF, and formal risk acceptance or exception processes. Also know common application flaws like injection, XSS, insecure deserialisation and broken access control.
Incident Response
NIST SP 800-61 is the framework to know cold: preparation, detection and analysis, containment, eradication and recovery, and post-incident activity. Questions often hand you a half-finished incident and ask for the next step. Understand evidence handling, chain of custody, order of volatility and when to involve legal or law enforcement.
Reporting and Communication
The smallest domain still carries 17%. You need to know which metrics matter to which audience (mean time to detect, mean time to respond, patch coverage), how to write for executives versus engineers, and what belongs in an incident report or a vulnerability report. Regulatory notification requirements and stakeholder management show up here too.
Common Exam Traps
The most common trap is picking the technically perfect answer when the question asks for the best answer given the business context. If a server is critical to revenue and the vulnerability isn't actively exploited, taking it offline is rarely right.
Another trap is jumping steps in incident response. If the scenario says you've just detected something, the answer is almost never "rebuild the server." Containment and evidence preservation come first.
Watch for scan results that look serious but are false positives. A finding for an Apache vulnerability on a server running IIS should make you suspicious, not alarmed.
Don't burn time on PBQs early. Many candidates flag them, finish the multiple choice and come back. That way a tricky simulation doesn't eat the time you needed for 20 easier questions.
Finally, read every word of the question. Phrases like "first," "most likely" and "best" change the answer completely.
Study Plan
| Week | Focus | Activities |
|---|---|---|
| 1 | Security Operations basics | Log types, SIEM and SOAR, network and endpoint indicators |
| 2 | Threat intel and hunting | MITRE ATT&CK, Diamond Model, hunting hypotheses, scripting basics |
| 3 | Vulnerability Management | Scan types, reading reports, CVSS, EPSS, KEV, false positives |
| 4 | Remediation and app security | Compensating controls, exceptions, OWASP flaws, hardening |
| 5 | Incident Response and Reporting | NIST 800-61, forensics, metrics, stakeholder communication |
| 6 | Practice and review | Full timed practice exams, review every wrong answer, revisit weak domains |
If you already work in a SOC, you might compress this to four weeks. If you're coming straight from Security+ with limited hands-on time, stretch it to eight and spend extra time in a home lab.
Recommended Resources
Start with the official CompTIA CS0-003 exam objectives. Print them and tick off each line as you go, because CompTIA only tests what's listed there.
Get hands-on wherever you can. Free tools like Security Onion, Wazuh, OpenVAS and Wireshark let you see real alerts and scan output, which makes PBQs feel familiar instead of foreign.
Read NIST SP 800-61 and skim the MITRE ATT&CK matrix. You don't need to memorise every technique, but you should recognise the common ones.
Practice questions are where it all comes together. Working through realistic scenarios trains the judgement CySA+ rewards, and reading detailed explanations for wrong answers closes gaps faster than rereading notes.
Final Thoughts
CySA+ isn't a memorisation exam. It's a judgement exam, and the best way to build judgement is repetition against realistic scenarios. Learn the frameworks, get your hands on real tools, and practise picking the most defensible answer under time pressure.
When you're ready to test yourself, try our CompTIA CySA+ CS0-003 Practice Exams. There are 500 questions mapped to the official domain weights, each with a full explanation of why the right answer is right and why the others aren't.