CySA+ study guide: the CS0-004 objectives, explained

Domain 1 is 34% of the exam and the only domain with six objectives. It checks that you can look at a host, a network segment or an identity log and say what is wrong.

• Architecture and logging (1.1): log ingestion, time sync and retention, zero trust network access (ZTNA), identity and secrets management, OT and ICS.
• Indicators of malicious activity (1.2): network, host, cloud and identity signs, from living-off-the-land binaries (LOLBins) to impossible travel and business email compromise.
• Security analysis tools (1.3): packet capture, security information and event management (SIEM), endpoint detection and response (EDR), sandboxes, YARA and the file formats tools emit.
• Threat intelligence and hunting (1.4): tactics, techniques and procedures (TTPs), confidence in intel, STRIDE threat modeling, cyber deception.
• Automation and process improvement (1.5): playbooks, SOAR, alert tuning, APIs and webhooks.
• AI in security operations (1.6): new in CS0-004; hallucinations, data exposure, model poisoning, malicious prompts and AI usage policy.

What trips people here is tool-name recognition. A stem that describes a symptom wants the meaning of the symptom, and the tool sitting in the options is often the distractor. Three concept pages settle the classic mix-ups: DNS tunneling vs DGA vs fast flux, SIEM vs SOAR vs EDR and the Pyramid of Pain for judging which indicators are worth chasing.

Tip: learn indicators before tools. Once you can say what a beacon or a rogue process looks like, a tool question shrinks to which tool would show it.

Domain 2 is 26% of CS0-004, down from 30% on CS0-003, and it runs like a pipeline: plan the scan, read the output, rank the findings, choose the control.

• Vulnerability scanning methods (2.1): asset inventory, credentialed and agent-based scans, passive and active discovery, baselines such as CIS Benchmarks and PCI DSS.
• Vulnerability assessment tools (2.2): Nmap, Nessus, OpenVAS, Nuclei, Burp Suite, cloud scanners such as Prowler and Trivy, breach-and-attack simulation.
• Prioritizing vulnerabilities (2.3): CVSS metrics, EPSS, exploitability, asset value, compensating controls and validating the fix.
• Controls and risk management (2.4): control types and functions, risk appetite, the four risk responses, SAST and DAST, software composition analysis (SCA) and the SBOM.

The trap is ranking by the Common Vulnerability Scoring System (CVSS) base score alone. CS0-004 names the Exploit Prediction Scoring System (EPSS) from FIRST, and a ticket that shows both wants severity weighed against the likelihood of exploitation, then against the asset. CVSS itself changed too: CVSS v4.0 replaced v3.1's Temporal metrics with Threat metrics. The pairs to separate are CVSS vs EPSS, CVSS v4.0 vs v3.1, credentialed vs non-credentialed scans, false positive vs false negative, compensating controls, SAST vs DAST vs SCA and the four risk responses.

Tip: read scanner output field by field: host, port, plugin or template, severity. A tool ticket usually turns on one of those fields.

Domain 3 is 24% of CS0-004, up four points, spread over three objectives.

• Attack frameworks (3.1): the Cyber Kill Chain, the Diamond Model of Intrusion Analysis and MITRE ATT&CK.
• Incident response process (3.2): seven steps, from preparation, detection and analysis through containment, eradication and recovery to post-incident work.
• Incident response techniques (3.3): triage, timelines, evidence and legal hold, isolation, escalation, root cause analysis.

The step list is the first trap. CompTIA's seven steps are the ones the exam marks. NIST's older four-phase cycle from NIST SP 800-61r2 was superseded by NIST SP 800-61r3 in April 2025, and SANS teaches six. The second trap is stale framework names: as of ATT&CK v19 there are 15 Enterprise tactics, and the tactic once called Defense Evasion is now Stealth (MITRE ATT&CK tactics, checked October 2026). Prep written for CS0-003 still says 14. Then the look-alikes: containment vs eradication vs recovery, chain of custody and order of volatility.

Tip: on any what-next ticket, name the current step before reading the options. The right answer is the next step, very rarely two ahead.

Domain 4 is 16% of CS0-004 and has two objectives. Vulnerability reporting (4.1) covers scan reports, risk scorecards, action plans and the inhibitors that stall a fix, such as a legacy system or a business process that cannot stop. Incident reporting and communication (4.2) covers declaration and escalation, the communication plan, lessons learned, shift handover and the metrics a SOC reports.

The trap is audience. An executive summary carries impact, risk and the decision needed; a technical report carries evidence and the fix. Executive summary vs technical report draws the line. The metrics come in near-identical names, mean time to detect, to respond, to remediate and to close, and MTTD vs MTTR vs MTTC pulls them apart.

Tip: this domain is vocabulary plus judgment, small enough for a few sessions. Pair the two drills with the CySA+ flashcards for the metric names.