CompTIA CySA+ (CS0-004) — the full course

Every lesson and every lab is free to read, mapped one-to-one to CompTIA’s published exam objectives. The paid tier adds the 500-question exam simulator; nothing is taken away from the free course to make room for it.

Prefer a book? The 500-question practice-test book is an ebook on Google Play.

Prefer timed practice exams on Udemy? The 500 questions from this course’s bank are there as timed practice tests: see the Udemy course (launch price until 16 Nov 2026).

Free for the first 100 learners this month: take the same Udemy practice tests free, until 21 Nov 2026 or until the places are taken.

If the tests help you, a rating on Udemy helps other learners find them.

7 lessons end with a short “try it” on a real Linux server that runs in your browser and checks each step, and the Linux sandbox gives you that machine with no task at all.

40written lessons
56hands-on labs
67hours of lab work
40audio episodes
500practice questions
Start with lesson 1 — What a security operations centre actually does Exam simulator

Jump to a domain: 1. Security Operations · 2. Vulnerability Management · 3. Incident Response and Management · 4. Reporting and Communication

What the exam weighs

Domain Share of the exam Lessons here
1. Security Operations 34% 15
2. Vulnerability Management 26% 10
3. Incident Response and Management 24% 9
4. Reporting and Communication 16% 5

The curriculum

1. Security Operations 34% of the exam

  1. 01 What a security operations centre actually does objective 1.1 part single
  2. 02 Network architecture, read the way an analyst reads it objective 1.1 part single
  3. 03 Identity as the new perimeter objective 1.1 part single
  4. 04 Logging: what to collect, and what you will regret not collecting objective 1.1 part single try it
  5. 05 Reading malicious activity on the network objective 1.2 part single
  6. 06 Reading malicious activity on a host objective 1.2 part single try it
  7. 07 Malicious activity in applications and cloud services objective 1.2 part single
  8. 08 Account compromise and identity-based attacks objective 1.2 part single
  9. 09 SIEM: searching, correlating and not drowning objective 1.3 part single try it
  10. 10 EDR and what it can and cannot see objective 1.3 part single
  11. 11 Packet analysis when the logs are not enough objective 1.3 part single try it
  12. 12 Threat intelligence that changes what you do objective 1.4 part single
  13. 13 Threat hunting: looking without an alert objective 1.4 part single try it
  14. 14 Automation, orchestration and getting time back objective 1.5 part single
  15. 15 AI in security operations: uses, risks and governance objective 1.6 part single

2. Vulnerability Management 26% of the exam

  1. 01 Choosing the right scan for the question objective 2.1 part single
  2. 02 Knowing what you have before you scan it objective 2.1 part single
  3. 03 Scanning web applications and APIs objective 2.1 part single
  4. 04 Reading scanner output without believing all of it objective 2.2 part single
  5. 05 Vulnerabilities in cloud and containers objective 2.2 part single
  6. 06 CVSS, and what a score does not tell you objective 2.3 part single
  7. 07 Prioritising with business context objective 2.3 part single
  8. 08 Fixing, mitigating and accepting objective 2.3 part single
  9. 09 Supply chain and dependency risk objective 2.4 part single
  10. 10 Controls, frameworks and where findings hang objective 2.4 part single

3. Incident Response and Management 24% of the exam

  1. 01 MITRE ATT&CK, the kill chain and the diamond model objective 3.1 part single
  2. 02 The incident response lifecycle objective 3.2 part single
  3. 03 Preparation: the phase that decides the other four objective 3.2 part single
  4. 04 Triage: deciding what this actually is objective 3.3 part single try it
  5. 05 Evidence that survives scrutiny objective 3.3 part single try it
  6. 06 Containing without destroying what you need objective 3.3 part single
  7. 07 Enough malware analysis to make a decision objective 3.3 part single
  8. 08 Responding to ransomware and extortion objective 3.3 part single
  9. 09 Root cause, and making the lesson stick objective 3.3 part single

Supplementary not examined — background reading

  1. 01 Building a detection lab you can break part single

The exam simulator

500 questions, every one mapped to an objective and to the lesson that teaches it. Timed full-length papers drawn to the real domain split, retakes weighted to your weak areas, and a readiness report from your own results.

Open the simulator See the paid tier

Every lesson has an audio episode, and it plays in the lesson itself — there is nothing extra to sign up for.

The episodes are also a podcast: listen on Spotify.

This is an independent study companion for CompTIA CySA+ CS0-004 and is not produced by or endorsed by CompTIA.