CySA+ CS0-004: What Changed From CS0-003, and How to Study for It

CompTIA launched CySA+ V4 — exam code CS0-004 — on June 23, 2026. If you’re deciding which CySA+ exam to take before CS0-003 retires on December 22, 2026, that decision framework is in our retirement post. This post is for the people who’ve already decided: you’re taking CS0-004, and you want to know exactly what’s different and how to study for it.

The format: unchanged

Start with what didn’t move, because it’s most of the exam experience. CS0-004 keeps the CS0-003 format: up to 85 questions, 165 minutes, scored 100–900 with 750 to pass, performance-based questions mixed with multiple choice. The voucher is the same $439. If you’ve read about what CySA+ sittings feel like, all of it still applies.

The certification you earn is also identical — a CySA+ pass is a CySA+ pass, valid three years, renewable through CE. Employers see the certification, not the exam code.

The domains: same four, new weights

CS0-004 keeps CS0-003’s four-domain structure and shifts the emphasis:

Domain	CS0-003	CS0-004	Direction
Security Operations	33%	34%	≈ unchanged
Vulnerability Management	30%	26%	down 4 points
Incident Response and Management	20%	24%	up 4 points
Reporting and Communication	17%	16%	≈ unchanged

One reading of that table matters more than the numbers: incident response is the growth area, and it grew by taking share from vulnerability management. On an 85-question exam, four percentage points is roughly three to four questions — not a revolution, but enough to change where your marginal study hour should go.

The two changes that actually affect your studying

1. Incident response is reframed around doing, not describing

CS0-003 asked plenty of “which phase is this?” questions about the incident response lifecycle. CS0-004’s incident response objectives push further into execution: triage decisions, evidence handling, escalation calls, root-cause analysis. Expect scenarios that put you mid-incident and ask what the analyst does next — the same reasoning your first SOC job tests, which is the point.

If your study materials treat incident response as vocabulary to memorize, they’re studying the old exam. Practice reading a scenario, identifying where you are in the process, and choosing the next action.

2. AI in security operations is a genuinely new objective

CS0-004 adds material that simply wasn’t on CS0-003: the use of AI tooling in security operations — its use cases, its risks, and the governance questions that come with it. This is the same modernization CompTIA has been rolling through its whole lineup, and it reflects what’s actually happening in SOCs: AI-assisted triage and detection tooling is showing up in analyst workflows, and CompTIA wants certified analysts to reason about it, not just use it blindly.

If you studied for CS0-003, this is the one area where your materials have a true blind spot rather than a stale emphasis.

What carries over from CS0-003 study

Most of it. Log analysis, threat hunting, vulnerability scanning and prioritization, indicator interpretation, and reporting fundamentals are all still the core of the exam. If you spent months in CS0-003 material, you have not wasted that time — you’ve built most of the foundation.

But “most of it transfers” is not the same as “you’re prepared.” The objectives, the domain weights, and the question pool are distinct. A study plan pointed at CS0-003 will overweight vulnerability management, underweight incident response, and miss the AI material entirely. Retarget the plan even though the knowledge transfers.

How to prepare for CS0-004

The prep sequence that works for CySA+ hasn’t changed, because the exam’s nature hasn’t: it’s an applied analysis exam that assumes Security+-level knowledge and tests whether you can do the work.

1. Study to the CS0-004 objectives specifically. Download the official objectives from CompTIA and check every resource you use against them — especially for the AI-in-security-operations material, where older resources have nothing.
2. Weight your time like the exam does. A third of your practice should be Security Operations, and incident response deserves more of your time than any CS0-003-era plan gave it.
3. Drill scenarios, not definitions. Read logs, spot the indicator, pick the response. Every practice question you review should teach you the analysis method, not just the fact.
4. Gate your booking on a readiness signal. Consistent high performance on fresh, full-length, domain-weighted practice — not a feeling — is what should trigger the $439 booking.

Our CySA+ CS0-004 practice bank is built for exactly this: 1,300 original questions mapped to the CS0-004 objectives — including the incident-response reframing and the new AI material — every answer explained, with PBQ-style questions and a 500-card flashcard deck, $59 once with lifetime access for the life of the exam version. And if you’re actually racing the CS0-003 deadline instead, that bank is still available through retirement.

The bottom line: CS0-004 is an evolution. Same format, same four domains, same certification. Study the incident response shift and the AI objectives deliberately, point everything at the new objective list, and it’s the same disciplined prep that has always passed CySA+.