CS0-004 security operations explained

Security Operations is the largest CS0-004 domain at 34% of the exam. It has six objectives (1.1 to 1.6) that cover how a security analyst reads an environment, spots malicious activity, uses detection tools, applies threat intelligence, improves the process and judges the use of AI. The domain is analyst-level: the question is rarely “what is a SIEM” and usually “what does this evidence mean, and what comes next”.

CompTIA publishes a summary of each objective on the CySA+ V4 page; the full objectives document is the authoritative list. The sections below follow that summary and explain what to reason about under each heading.

1.1 System and network architecture concepts

This objective covers security architecture components, identity concepts and logging practices. An analyst needs the architecture in mind because alerts only make sense against it: a connection from a workstation segment to a database segment is normal or alarming depending on how the network is designed.

• Architecture. Segmentation, zones, proxies, firewalls and cloud boundaries decide where traffic can legitimately flow. Zero trust removes the assumption that the internal network is trusted; zero trust network access (ZTNA) applies it to remote access, and secure access service edge (SASE) delivers network and security functions from the cloud. CompTIA’s V4 blog lists both as expanded coverage.
• Identity. Authentication and authorization events, federation, privileged accounts and service accounts. Many intrusions are visible mainly as odd identity behaviour.
• Logging. What is collected, how long it is kept, whether clocks are synchronised and whether logs are protected from tampering. A log that was never collected cannot be searched.

1.2 Indicators of potential malicious activity

The objective groups indicators by where they appear: networks, endpoints, cloud and identity systems. Learn the pattern for each source rather than a list of signatures.

1.3 Tools to determine malicious activity

The objective names SIEM, EDR, packet analysis tools and threat intelligence platforms. What matters is the question each tool answers.

A SIEM collects and correlates logs. SOAR runs automated playbooks on alerts. XDR extends endpoint detection by correlating telemetry across endpoints, email, identity, cloud and network. The SIEM, SOAR and XDR comparison separates these roles, which scenarios often blur.

1.4 Threat intelligence and threat hunting

Intelligence turns raw indicators into context: who is likely targeting the organisation, with which techniques, and what to look for. Frameworks such as MITRE ATT&CK give a shared vocabulary for adversary behaviour. Data sources include open-source intelligence, commercial feeds, sector sharing groups (ISACs) and internal telemetry, and indicators are often exchanged in the STIX format over TAXII. Confidence in a source and the age of an indicator matter as much as the indicator itself. Threat hunting is the proactive part: an analyst forms a hypothesis (“an attacker with this technique would leave this trace”) and searches the data for it before any alert fires. A hunt that finds nothing still produces value if it reveals missing logging.

1.5 Efficiency and process improvement

Automation, workflows and process. The analyst view is to automate the repetitive, well-understood work, such as enrichment of an alert with reputation data or opening a ticket, and keep a human on decisions with business impact. Typical points to reason about: tuning noisy rules to cut false positives, measuring whether a playbook actually shortens response, and avoiding automation that can take a production system offline on a false positive.

1.6 AI in security operations

This is the objective new in V4. The summary names use cases, risks and governance. Use cases include summarising alerts, drafting queries and triaging. The risks are wrong or invented output (hallucination), data leaking into external services, prompt injection (hostile text in the input that steers the model), poisoned training or reference data, and over-trust. Governance means approved tools, human review, logging of AI use and clear accountability. See AI governance and risk for the vocabulary.

Worked mini-scenario

A SIEM alert shows a user signing in from two countries within ten minutes, then a new mailbox forwarding rule. The sensible order is to confirm with identity logs whether the two sign-ins are one user and a VPN, check the EDR timeline of the user’s laptop for suspicious processes, then, if compromise is plausible, reset credentials, revoke sessions and remove the rule. The evidence is correlated before action is taken.

Easy to confuse

• Indicator of compromise vs indicator of attack. An IoC is a trace that something happened (a hash, an address); an IoA describes behaviour in progress.
• False positive vs false negative. An alert with no attack is the first; a missed attack is the second and is the more dangerous.
• Threat hunting vs alert triage. Hunting starts from a hypothesis, triage starts from an alert.
• Logs vs flow data vs packets. Logs record events, flow data records who talked to whom, packets contain content.

Exam-style pitfall: choosing the most powerful action rather than the first sensible one. When evidence is thin, the best answer is usually to gather the next piece of evidence, not to rebuild a host.

Example questions