Lesson 1: Exam Briefing: CS0-004 Facts and Question Styles

Welcome to CySA+ V4 (CS0-004)

This first level is a briefing. You will learn the exam's numbers, where to get CompTIA's official checklist and how each question type works. Later levels teach the technical content.

Important notices

• LevelUpWith is independent of CompTIA. This course is not endorsed by CompTIA and has no official link to it.
• The exam objectives belong to CompTIA. They are not reproduced here. You can download them free from CompTIA's site.
• This course is designed to help you prepare, but passing is not promised. Your result depends on your study, practice and performance on exam day.

Task 1: Memorise the Exam Facts

CompTIA publishes these facts for CySA+ V4:

The previous version, CS0-003 (CySA+ V3), retires in English on 22 December 2026. The Japanese, Portuguese and Spanish versions retire on 23 March 2027. Until 22 December 2026 both English versions can be booked. Choose CS0-004 to match this course.

Two points that candidates often get wrong:

1. 750 is a scaled score, not a percentage. The scale runs from 100 to 900, so 750 does not mean "75% correct". Don't try to work out a raw percentage. Aim to know every objective well.
2. "Up to 85" means your exam may have fewer questions. Pace yourself by the clock, not by an expected count.

DO: Write the five numbers (85, 165, 750, 100-900, 22 December 2026) on a card and say them from memory before you go on.

Task 2: Learn the Domain Weights

CS0-004 has four domains. The weight tells you roughly what share of the exam each one covers.

1. Security Operations: 34%. The largest domain.
2. Vulnerability Management: 26%
3. Incident Response and Management: 24%
4. Reporting and Communication: 16%

The weights add up to 100%. Use them to plan your study time. On an 85-question exam, 34% is roughly 29 questions on Security Operations. 16% is roughly 13-14 questions on Reporting and Communication. That is the smallest domain, but too many marks to skip.

DO: Split your weekly study hours in about the same ratio, for example 3.5 : 2.5 : 2.5 : 1.5 hours across a 10-hour week.

Task 3: Download the Official Objectives and Use Them as a Checklist

The objectives document is CompTIA's definition of what the exam can test. Treat it as your master checklist.

1. Go to CompTIA's CySA+ page at comptia.org and open the V4 (CS0-004) section.
2. Request the free exam objectives download. Make sure the code on the document reads CS0-004, not CS0-003.
3. Find the acronym list that comes with the objectives. This course spells out each acronym where its topic is taught.
4. Copy every objective and sub-bullet into a spreadsheet. Add the columns Domain, Objective, Confidence (1-5), Level studied and Date reviewed.
5. After each LevelUpWith level, update your confidence scores.
6. In the final weeks, revise every row scored 3 or lower first, starting with the highest-weighted domain.

Example checklist row:

Domain | Objective              | Confidence | Level studied | Reviewed
1.0    | (copy text from PDF)   | 2          | L2            | 2026-10-25

The examples listed under each objective show you the kind of thing that can be tested. Don't treat them as a complete list.

Task 4: Recognise the Question Styles

You will see three practical styles.

1. Standard multiple-choice

• A short question with one correct answer, or an instruction such as "Choose two".
• Tests recall: definitions, acronyms, which tool does what.
• Example form: "Which tool records full network traffic for later analysis?"

2. Scenario best-answer (also multiple-choice)

• A short case: an alert, a log extract or a manager's request, followed by several options that could all work.
• You must choose the best option for the situation as described. Look for limiting words: first, best, most likely, next.
• Method:
  1. Read the final sentence first so you know what is being asked.
  2. Note the constraints in the scenario (time, cost, business impact, role).
  3. Rule out options that are wrong or that skip a step.
  4. Of the options left, choose the one that fits every constraint.

3. Performance-based questions (PBQs)

• Interactive tasks in a simulated environment. Common formats include drag-and-drop matching or ordering, a simulated tool or console, and reviewing logs or output to pick findings.
• They test whether you can do the job, not just recall facts.
• They usually take longer than multiple-choice items.

Task 5: Plan Your Time

You have 165 minutes for up to 85 questions, which is just under 2 minutes per question on average. PBQs need more time, so budget for them.

1. First pass: answer the multiple-choice questions you are sure of, at about 1 minute each. Mark any you are unsure of if the review option is available.
2. PBQs: give each one a firm time limit, for example 8-10 minutes. Complete every part you can. Don't spend 25 minutes on one item.
3. Second pass: go back to the questions you marked.
4. Final 5 minutes: make sure nothing is left blank. A guess can earn marks, but a blank cannot.

DO: In every practice exam, record how many minutes you have left at questions 20, 40 and 60. Aim for about 125, 85 and 45 minutes.

What the Exam Asks About This

The exam doesn't ask about its own format, but knowing the format affects your score:

• Scenario wording (first, best, next) decides which plausible option is correct.
• PBQs reward hands-on practice with logs, queries and tool output, which later levels include.
• The domain weights show where most of the marks are: Security Operations first.

Key Takeaways

• CS0-004: up to 85 questions, 165 minutes, pass at 750 on a 100-900 scale.
• Domains: Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%.
• CS0-003 retires in English on 22 December 2026.
• Download CompTIA's free objectives and acronym list and use them as a scored checklist.
• There are three styles: multiple-choice, scenario best-answer and PBQ. Give PBQs a time limit and mark hard items to come back to.
• LevelUpWith is independent of CompTIA, and passing is not promised.