CompTIA CySA+ CS0-004 (V4) Exam Objectives
This page translates the official CompTIA CySA+ CS0-004 (V4) exam objectives into clear, practical language. You’ll see what each domain covers, realistic task themes, and a focused study plan that turns objectives into repeatable labs, PBQs, and job-ready SOC skills.
Test at a glance: multiple-choice and performance-based items, recommended ~4 years hands-on in SOC Level 2 or vulnerability analyst roles.
Last updated: November 9, 2025. Always verify against the official CompTIA blueprint before your exam.
TL;DR: CySA+ (V4) validates the ability to operate a SOC, manage vulnerabilities, run incident response, and produce reporting that drives decisions. Domains and weights: 1) Security Operations (34%) 2) Vulnerability Management (26%) 3) Incident Response & Management (24%) 4) Reporting & Communication (16%)
Table of Contents
- What Is Covered on CompTIA CySA+ CS0-004 (V4¡)?
- Objective-By-Objective Breakdown (with examples)
- Why CySA+ for SOC/Blue-Team Roles?
- Study Plan: How to Master the CS0-004 Objectives
- Free Checklist & Next Steps
- Frequently Asked Questions
What Is Covered on CompTIA CySA+ CS0-004 (V4)?
CySA+ confirms you can:
- Detect and analyze indicators of malicious activity to support security operations.
- Run vulnerability management programs and prioritize remediation.
- Execute incident response activities end-to-end.
- Communicate findings with reports, metrics, and stakeholder-appropriate language.
Note
Wording below is learner-friendly. Map your prep to the official CS0-003 (V3) objectives before test day.
Objective-By-Objective Breakdown (with examples)
1) Security Operations — 34%
Turn findings into prioritized, risk-informed actions. Focus: architecture literacy, detection, tooling, threat intel/hunting, process efficiency, and AI use.- Architecture & foundations: logging (ingestion, config, integrity/security, time sync, retention), OS concepts (hardening, file structures, critical files, processes), infrastructure (cloud-native, virtualization, containers, APIs), device management (mobile/endpoints), network models (ZTNA, SASE, hybrid cloud), IAM (PAM, authN/Z methods, secrets mgmt), encryption & data protection, and OT/ICS/SCADA basics.
- Indicators of malicious activity: network (rogue devices, enumeration, unexpected ports), host (resource spikes, unauthorized software, LOLBins, file changes, exfil), application and cloud anomalies, social engineering (typosquatting, short URLs), identity-based indicators (impossible travel, unauthorized access), and BEC.
- Tools & formats: packet analysis (Wireshark, tcpdump; Snort/Suricata/Zeek), SIEM, TIPs (OTX, MISP, OpenCTI), EDR/XDR, MDM, WHOIS/AbuseIPDB/GEO-IP, VirusTotal, YARA, CyberChef, MXToolbox; file formats JSON, XML, YAML, EVTX; scripting with Python, PowerShell, shell.
- Threat intel & hunting: actors (APT, insiders), TTPs (MITRE ATT&CK, pyramid of pain, attribution, heat maps), IoCs (collection/analysis/usage; atomic vs behavioral), STRIDE threat modeling, threat mapping, and cyber deception.
- Efficiency & process improvement: standardized playbooks/runbooks, SOAR, IaC hooks, data enrichment, alert/rule tuning, dashboards; API/webhooks/plugin integrations.
- AI in security ops: risks (hallucinations, data exposure, poisoning, malicious prompts), governance (policy, legal/regulatory), and use cases (artifact comparison, log analysis, doc creation, investigations, correlation, automation/orchestration).
2) Vulnerability Management — 26%
Harden endpoints, services, and applications. Focus: scanning methods, baselines, analysis/triage, treatment, and process maturity.- Scanning approaches: asset inventory; plan for schedule, ops impact, performance, sensitivity, segmentation, regulatory requirements; internal vs external, agent vs agentless, credentialed vs non-credentialed, passive vs active, discovery/mapping/fingerprinting; baseline scans (PCI DSS, CIS, ISO 27000).
- Analysis & prioritization: consolidate findings, deduplicate, validate, assign risk (CVSS + context), map to exploitability and business impact; handle false positives; track exceptions.
- Treatment & validation: patching, config changes, compensating controls; coordinate windows/rollback; retest and verify remediation; report status and blockers.
3) Incident Response & Management — 24%
Focus: frameworks, lifecycle, and evidence.- Framework literacy: kill chain, MITRE ATT&CK, Diamond Model, OSSTMM/OWASP testing guide (for context).
- Lifecycle: detect → analyze → contain → eradicate → recover → post-incident (forensics, RCA, lessons learned).
- Readiness: plans, tools, playbooks, tabletop exercises/training, BC/DR alignment.
Reporting & Communication — 16%
Focus: turning data into decisions—safely and clearly.- Vulnerability reporting: compliance views, action plans, inhibitors to remediation, metrics/KPIs.
- IR reporting: incident declaration/escalation, statuses, stakeholder comms, RCA, lessons learned, and effectiveness metrics.
Why CySA+ for SOC/Blue-Team Roles?
CySA+ (V4) proves you can run day-to-day SOC operations, drive a vulnerability program, and execute IR with evidence-backed reporting. It aligns to roles such as SOC analyst (Tier 1/2), cyber defense analyst, incident responder, vulnerability analyst, and security operations engineer.
Study Plan: How to Master the CS0-004 Objectives
- Build a mini SOC pipeline
Deploy a SIEM and connect logs from an endpoint (EDR), a network sensor (Zeek/Snort/Suricata), and a cloud account. Add time sync, parsing, baselines, alert tuning, and a simple dashboard. Capture screenshots and configs as “evidence.” - Vulnerability mgmt sprints
Run credentialed internal and agentless external scans on a small lab. Triage by exploitability + business impact, plan maintenance windows, execute fixes with rollback, and retest. Document exceptions and metrics. - Incident response rehearsal
Use ATT&CK to script a small scenario (phishing → BEC or impossible travel leading to session theft). Walk through detection, containment, eradication, and recovery; finish with RCA and lessons learned. - Threat hunting reps
Create two hypothesis-driven hunts (e.g., rogue device enumeration; excessive OAuth grants). Record queries, evidence, and outcome. Add a Sigma or YARA rule for a discovered pattern. - Responsible AI in Ops
Write a one-page AI usage policy for your SOC (approved tools, sensitive-data handling, logging/monitoring, review/rollback). Pilot AI-assisted log summarization, then test for hallucinations and leakage.
