Full exam simulation
85 questions · 165 minutes, 0 unscored and not identified. One question per screen, flag and strike-out, a review screen and a score report per domain — no answers until you finish.
CompTIACS0-004ProfessionalSecurity · Cybersecurity · V4Available
CompTIA CySA+ (Cybersecurity Analyst)
Security operations, threat hunting, vulnerability management, incident response and reporting for SOC and vulnerability analysts.
Independent practice — not affiliated with or endorsed by CompTIA. CS0-004 is used only to identify the exam. Trademark notices
Domain weights
Share of scored content per domain. Every sitting draws questions by these weights.
- D1Security Operations34 %30 concepts
- D2Vulnerability Management26 %23 concepts
- D3Incident Response and Management24 %21 concepts
- D4Reporting and Communication16 %15 concepts
Your progress
No attempts yet. Take a full sitting to get a readiness rating; results are kept in this browser. Join your class to keep them on every device.
Choose a mode
ESL +30
The full sitting with 30 extra minutes (195 min) — the accommodation non-native English speakers can request for exams in English.
Quick 20
20 questions · 39 min, same weights, all scored. A daily check.
Weak spots
20 questions aimed at your weakest domains, missed concepts and due reviews.
Practice builder
Pick domains, topics, how many questions and which pool (new, wrong, due, low confidence). Spaced repetition with confidence ratings, flashcards and a mistake book.
Open practiceDomain drill
One domain, up to 20 questions.
What's on the exam
Domain 1: Security Operations
34 %Logging, OS and infrastructure concepts, ZTNA, SASE, IAM, PAM, OT/ICS; indicators of malicious activity; SIEM, EDR, packet, file, email and reputation tools; threat intelligence and hunting; SOAR, playbooks and process improvement; AI use cases, risks and governance in the SOC.
Practice domain 1 →Domain 2: Vulnerability Management
26 %Asset inventory and scan planning; scan types and baselines; output from Nmap, Nessus, OpenVAS, Burp, ZAP, cloud and BAS tools; prioritizing with CVSS, EPSS, exploitation and asset context; mitigation, exceptions and validation; control types, risk concepts, SAST/DAST and third-party risk.
Practice domain 2 →Domain 3: Incident Response and Management
24 %Cyber Kill Chain, Diamond Model and MITRE ATT&CK; the incident response process from preparation to post-incident; plans, playbooks, exercises, log correlation, triage, evidence and chain of custody, isolation, escalation, restoration and root cause analysis.
Practice domain 3 →Domain 4: Reporting and Communication
16 %Vulnerability scan reports, compliance findings, risk scorecards, action plans and inhibitors to remediation; stakeholder communication, executive summaries, incident declaration, regulatory and law-enforcement reporting, after-action reports and SOC metrics such as MTTD and MTTR.
Practice domain 4 →
Domain names and weights come from the official CS0-004 exam objectives (checked 2026-10-27). Always check it for the authoritative scope.
Includes 29 performance-style items (put in order, match, read an exhibit) — practice them with the “Order / match” filter.
The real exam's full performance-based simulations simulations (labs in a live interface) are not reproduced.
Sources · checked 2026-10-27
Sample questions
Two of this exam's original questions, with the explanation you get after every answer.
Sample 1Select one
An analyst correlating firewall, proxy and domain controller logs finds that events for the same session appear minutes apart. What should be fixed FIRST?
- ALog retention period on the SIEM
- BTime synchronization of all log sources to a common NTP source
- CEncryption of the syslog transport between the log sources and the SIEM
- DThe number of SIEM dashboards
Show answer & explanation
Correct: B. Correlation and timelines depend on consistent timestamps. All sources should sync to authoritative NTP and logs should be normalized to UTC.
Sample 2Select 2
Which actions are part of system hardening? (Select TWO.)
- ADisable unneeded services and close unused ports
- BApply a secure configuration baseline such as a CIS Benchmark
- CEnable guest accounts for easier troubleshooting
- DGrant users local administrator rights
- ETurn off automatic updates
Show answer & explanation
Correct: A, B. Hardening reduces attack surface by removing what is not needed and enforcing secure settings.