What's on the CompTIA CySA+ Exam? The CS0-004 Domains, Objectives, and Changes From V3

The four CS0-004 domains and their weights

Everything CySA+ V4 measures comes from one document: CompTIA's CS0-004 exam objectives, document version 2.0, for the version that launched on June 23, 2026. It lists four domains, and CompTIA's CySA+ V4 page shows the same weights.

The last column multiplies each weight by 85, the maximum number of questions CompTIA lists. For Security Operations, 0.34 × 85 = 28.9, so about 29. Treat it as a picture of relative emphasis, not a count: your form may have fewer than 85 questions, it mixes multiple-choice and performance-based items, and neither the objectives document nor the V4 page gives a per-domain item count. For practice, full CySA+ prep planned for launch sizes each domain's question set to these weights, from 216 Reporting and Communication questions to 459 for Security Operations.

The weights also hide a density difference. Security Operations spreads 34% over six objectives, about 5.7% each if the share were even. Incident Response and Management spreads 24% over three, and Reporting and Communication 16% over two, so each of those objectives carries about 8%. The objectives document weights domains, not individual objectives, so this is only a rough guide, but it explains why a single objective such as incident response techniques deserves more time than its domain's rank suggests.

All 15 CS0-004 objectives in plain words

Each objective starts with a verb, and the verb tells you the depth. "Explain" and "Summarize" ask you to know and distinguish ideas. "Given a scenario" asks you to apply a topic to a situation, such as an alert, a scan result or an incident. Six of the 15 objectives use that phrase, and all six sit in the first three domains. The objectives document does not say which objectives become performance-based questions, but scenario objectives are the natural place to expect hands-on tasks.

These are short paraphrases. Read the objectives document itself for the full lists, and keep one rule from its second page in mind: CompTIA says the bulleted examples are not exhaustive, so related technologies, processes or tasks may appear on the exam. The same document ends with an acronym list of 81 entries and a sample hardware and software list for building a practice lab.

Two wording slips in the document are worth knowing. Objective 2.3 expands EPSS as "First Exploitability Prediction Scoring System," and the acronym list prints "Exploitability Predication Scoring System." The organization that runs it, FIRST, calls it the Exploit Prediction Scoring System. ZTNA also appears two ways: "Zero Trust Network Architecture" in objective 1.1 and "Zero Trust Network Access" in the acronym list. Learn both names so neither one surprises you in a question.

What changed from CS0-003 to CS0-004

The format did not change. CompTIA's V3 and V4 pages both list a maximum of 85 multiple-choice and performance-based questions, 165 minutes, and a passing score of 750 on the 100 to 900 scale. The weights did change:

The biggest shift is four points moving from Vulnerability Management to Incident Response and Management. Comparing CompTIA's V3 page summary with the V4 objectives shows a few more differences:

• AI is a new objective. Objective 1.6 covers the use of AI in security operations. CompTIA's V4 FAQ names AI concepts among what the new version introduces.
• Threat modeling moved. The V3 page summary placed threat modeling under vulnerability response. In V4, STRIDE threat modeling sits in objective 1.4 with threat intelligence and hunting.
• The framework objective is shorter. The V3 page summary listed five attack methodology frameworks, including OSSTMM and the OWASP testing guide. V4's objective 3.1 names three: the Cyber Kill Chain, the Diamond Model and MITRE ATT&CK. OSSTMM and OWASP still appear in the V4 acronym list.
• Vulnerability work has four objectives, not five topics. V4 combines prioritization and mitigation in objective 2.3 and groups control types, risk concepts, application security and third-party risk in 2.4.

CompTIA's FAQ adds its own summary of V4: wider coverage of security operations, cloud and hybrid environments and identity-based threats, and greater emphasis on vulnerability prioritization and risk-based decisions. If your notes or practice questions were written for CS0-003, check each topic against the CS0-004 objectives before you rely on it. Full CySA+ prep planned for launch is written for the CS0-004 objectives, not for CS0-003.

Which CySA+ version applies to your exam date

For an English exam in 2027, CS0-004 is the only CySA+ version you can take. A candidate testing in Japanese, Portuguese or Spanish early in 2027 may still find V3 in that language until March 23, 2027, so check which versions comptia.org shows before you buy a voucher. CompTIA's page of draft objectives under development listed no CySA+ draft as of October 29, 2026, so no draft for a successor to V4 was posted there.

Turning the CS0-004 weights into study time

A simple way to use the weights is to split your hours by them and then adjust for your gaps. With 60 hours, a straight split gives about 20 hours to Security Operations, 16 to Vulnerability Management, 14 to Incident Response and Management, and 10 to Reporting and Communication. That is an editorial starting point, not a CompTIA rule. Move hours toward the domain where you have the least job experience.

Then study each domain the way the verbs ask:

1. For the six scenario objectives, practice reading evidence: log lines, packet details, scan output and incident timelines. Ask what the evidence shows and what the analyst should do next.
2. For the "Explain" and "Summarize" objectives, make sure you can tell close terms apart, such as a CVSS base score and an EPSS probability, or containment and eradication.
3. For the acronym list, work through all 81 entries until you can expand and explain each one, since the document encourages a working knowledge of every listed acronym.

When the scenario work starts to feel familiar, rehearse the clock. The exam gives 165 minutes for up to 85 questions, about 1.9 minutes each on average, and full CySA+ prep at launch includes an 85-question, 165-minute timed mock exam for that pacing.

Your first step with the CS0-004 objectives

Start by finding where you stand. The 20 free CySA+ practice questions are split across the four domains by their weights, explain every option, and end with a breakdown by domain. Use that breakdown to choose the weak domain in the free CySA+ study planner, which turns your exam date and daily minutes into a dated outline.

Once you know which objectives need the most work, keep the acronym list and the named tools in short daily reviews alongside the scenario work. For that recall layer, see how the 500 flashcards planned for full CySA+ prep are sorted by domain.