CompTIA CySA+ (CS0-004) Study Guide: What Changed in the V4 Relaunch
Last updated October 24, 2026
CompTIA replaced CySA+ CS0-003 with CS0-004 on June 23, 2026 (CS0-003 stays valid for the English-language exam only until December 22, 2026), and it's a bigger revision than a typical version bump. The domain weights shifted, and the exam added dedicated content on AI use, governance, and risk across the SOC analyst workflow — one of the first mainstream CompTIA exams to test AI judgment directly rather than treat it as a side topic. Here's what changed, how the exam is weighted now, and where candidates lose points.
What actually changed in the V4 relaunch
- Domain weights shifted toward Security Operations. It now carries 34% of the exam, up from a smaller share under CS0-003, absorbing more of the day-to-day detection, monitoring, and automation content.
- AI use, governance, and risk is now dedicated exam content. This isn't a single topic tucked into one domain — it spans all four domains: AI-assisted detection and triage in Security Operations, AI governance reporting in Reporting and Communication, and the adversarial risks AI introduces (prompt injection, AI-generated phishing, deepfake fraud) woven throughout.
- Performance-based question (PBQ) format expanded. CS0-004 leans more heavily on scenario clusters — a shared log excerpt, vulnerability scan output, SOC metrics dashboard, or incident timeline followed by several related questions — to approximate the hands-on judgment a static multiple-choice question alone can't fully test.
If you're studying from material written before mid-2026, assume the domain percentages are out of date and that it has no AI-specific content at all.
How the exam is weighted
CompTIA publishes an official domain breakdown for CS0-004, and it should directly drive how you allocate study time:
- Security Operations (34%) — the largest domain by a wide margin. System and network architecture, threat detection, threat intelligence, monitoring, automation, and the role of AI in day-to-day security operations.
- Vulnerability Management (26%) — vulnerability scanning, risk-based prioritization (weighing both CVSS severity and real-world exposure, not just the score alone), patch management, and supply-chain and software composition risk.
- Incident Response and Management (24%) — detection, containment, eradication, recovery, forensics, and incident response planning, including evidence handling and chain of custody.
- Reporting and Communication (16%) — vulnerability reporting, incident documentation, executive communication, metrics, compliance reporting, and now AI governance reporting specifically.
What each domain actually tests
Security Operations tests pattern recognition under ambiguity: a respawning startup script with unknown outbound connections reads as persistence and likely malicious activity, and unusual archive creation followed by off-hours outbound transfer reads as staged data exfiltration, even when no single indicator alone would be conclusive. This domain is also where most of the new AI content lives — recognizing when an AI-assisted SOC copilot's recommendation should be independently verified rather than trusted or dismissed outright, since AI tooling is tested as something that should augment, not replace, analyst judgment.
Vulnerability Management tests risk-based prioritization specifically: a lower-CVSS finding on an internet-facing system doesn't automatically outrank a higher-CVSS finding on an isolated one, and the exam wants you to weigh severity and exposure together rather than defaulting to either factor alone. Secure coding concepts (output encoding versus input validation for an XSS fix) and scanner configuration (authenticated versus unauthenticated scanning) round out the domain.
Incident Response and Management tests sequencing and evidence discipline: volatile memory and active system state must be captured before a compromised system is powered off, since that evidence is lost at shutdown, and mishandled evidence — moved without documentation or through an unapproved channel — threatens chain of custody regardless of whether the underlying compromise was contained. Phase recognition (is this recovery, or still initial analysis?) is tested directly and repeatedly.
Reporting and Communication covers routing the right information to the right audience: legally mandated disclosure goes through regulatory reporting specifically, and — new to CS0-004 — summarizing AI-related risk (model risk, data poisoning, adversarial inputs) for a business audience gets the same structured treatment as any other risk category, not treated as too new or too technical to report on in business terms.
How long should you study
Candidates already working in a SOC or vulnerability management role typically prepare in five to seven weeks, concentrated on the reweighted domain percentages and the new AI-risk content if their current role hasn't touched it yet. Candidates coming from a more general security background, even with a Security+ foundation, often need eight to ten weeks to build comfortable familiarity with the incident-response sequencing and risk-based prioritization judgment the exam leans on heavily.
Where candidates lose points
- Studying pre-June-2026 material. Old domain weightings and the complete absence of AI-risk content are the two most common outdated gaps in older CySA+ prep.
- Treating AI-related questions as a side topic instead of exam content spanning every domain. AI governance, AI-assisted tooling risk, and AI-enabled attack techniques are tested throughout Security Operations, Incident Response, and Reporting — not confined to one section you can skim.
- Prioritizing by CVSS score alone. The exam consistently tests risk-based prioritization that weighs exposure alongside severity, and a pure severity-ranking habit costs points.
- Missing evidence-handling discipline in incident response scenarios. Questions reward recognizing chain-of-custody risk even when the mishandling didn't change the technical outcome of the incident.
Why full-rationale practice questions help
CS0-004 tests judgment calls more than factual recall — which finding to prioritize first, what to verify before acting on an AI recommendation, which phase an activity belongs to — so the value of practice is in understanding why the three other options fail against the specific scenario detail, not just confirming the correct letter. Full rationale on every choice makes those scenario-specific failure points visible, which is exactly the skill the real exam is testing.
CompTIA CySA+ Cybersecurity Analyst (CS0-004 V4) — $24.99, instant PDF download with full rationale on every answer.
View the practice questions →If you're building a broader security path
CySA+ sits between a foundational security credential and the more offense-focused or management-level certifications that often follow it: