Last-minute reference for CS0-004, the CompTIA CySA+ V4 exam. Security Operations is the largest domain; Reporting and Communication the smallest.
Exam facts
| |
|---|
| Questions | Maximum 85 |
| Duration | 165 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Launch | June 23, 2026 |
| Question types | Multiple-choice and performance-based (CompTIA blog) |
| Price | Not published on the CompTIA exam page |
| Recommended experience | About four years as a SOC or vulnerability analyst |
| Languages | English; further languages announced as coming |
| CS0-003 retirement | English exam retires December 22, 2026 |
Domains
| Domain | Weight |
|---|
| 1.0 Security Operations | 34% |
| 2.0 Vulnerability Management | 26% |
| 3.0 Incident Response and Management | 24% |
| 4.0 Reporting and Communication | 16% |
Incident response order
Preparation, detection, analysis, containment, eradication, recovery, then post-incident activity. Contain before eradicate, eradicate before recover. Preserve evidence before wiping. See the lifecycle guide.
| Question | Tool |
|---|
| What do many log sources show together? | SIEM |
| What happened on this host, can it be isolated? | EDR |
| What was sent on the wire? | Packet capture |
| Is this indicator known? | Threat intelligence platform |
| Automate a repeatable response | SOAR playbook |
| Input | Use |
|---|
| CVSS | Severity of the flaw |
| EPSS | Likelihood of exploitation |
| CISA KEV | Known to be exploited |
| Asset criticality and exposure | Business impact and reachability |
| Compensating controls | Reduce real risk |
| SBOM | Match a new library flaw to affected software |
Scan choice: credentialed for accuracy, non-credentialed for the attacker view, agent-based for roaming hosts, passive for fragile environments. Scanner finding contradicted by evidence is a false positive.
Frameworks
| Framework | Purpose |
|---|
| MITRE ATT&CK | Catalogue of adversary tactics and techniques |
| Cyber Kill Chain | Seven stages of an intrusion, from reconnaissance to actions on objectives |
| NIST SP 800-61 | Incident handling |
| NIST SP 800-40 | Patch management |
Reporting metrics
Time to detect, time to respond and remediation effectiveness. Match the audience: executives get risk and trend, technical teams get detail and steps.
Clue to answer
| Clue | Answer |
|---|
| Hypothesis searched before any alert | Threat hunting |
| Scanner flaw absent on inspection | False positive |
| Alert missed a real attack | False negative |
| Same score, one internet-facing and exploited | Fix that one first |
| Evidence needed for court | Chain of custody, preserve first |
| AI output drives a decision | Human verification and governance |
Common traps
- Highest CVSS first with no other context.
- Recovering before containing.
- Dropping the hunt when nothing is found; missing logging is also a finding.
- Reporting identical content to executives and engineers.
Practise with the sample questions and the study plan.