CS0-004 Cheat Sheet: Key Facts to Review

The short version

This sheet lists the ideas that CySA+ questions keep returning to: confusable pairs, decision rules, and traps. It is a review aid, not a full course, and it does not cover everything on the exam. The objectives are the reference. Use this page to jog your memory after you have studied.

Exam facts at a glance

Item	Fact
Code	CS0-004 (V4)
Questions	Maximum of 85, multiple-choice and performance-based
Time	165 minutes
Passing score	750 on a scale of 100 to 900
Domains	Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, Reporting and Communication 16%
Retakes	None required before the 2nd attempt; 14 calendar days before the 3rd and later
Validity	Three years

Domain 1: Security Operations (34%)

Confusable pairs

Snort and Suricata are network detection engines; Zeek turns traffic into rich logs; Wireshark is for reading packets by hand; tcpdump captures packets from the command line.
SIEM collects and correlates logs. SOAR automates the response steps. EDR watches endpoints. XDR spans more sources.
OSINT comes from public sources. Closed-source intelligence does not.
Atomic indicators are single values, such as an IP address or hash. Behavioral indicators describe how an attacker acts.
ZTNA controls access to applications by identity and context. SASE combines network and security services delivered from the cloud.
Hardening reduces what a system exposes. Segmentation limits where an attacker can go.

Decision rules

A tool name alone rarely decides the answer. Ask what job is needed: decode (CyberChef), reputation check (AbuseIPDB, VirusTotal), file matching (YARA), detonation (a sandbox), mail headers (MXToolbox).
“Impossible travel” or logins from far-apart places in a short time points to identity compromise.
A normal system binary doing odd things points to living off the land.
If intelligence is old, off-topic, or unproven, lower your confidence. Timeliness, relevance, and accuracy drive it.
Repeated, manual work is a candidate for a playbook or automation.

AI in security operations. Know the four risks: hallucinations, data exposure, model poisoning, and malicious prompts. Know that governance means compliance and usage policies.

Traps. Mixing a capture filter with a display filter. Trusting a single threat feed. Forgetting that logs need synchronized time, integrity, and retention to be useful as evidence.

Domain 2: Vulnerability Management (26%)

Confusable pairs

Credentialed scans see inside the host; non-credentialed scans show the outside view.
Agent-based scanning runs software on the asset; agentless does not.
Active scanning sends probes; passive scanning listens.
Internal and external scans see different attack surfaces.
SAST reads code at rest; DAST tests the running application; SCA finds known-vulnerable components; an SBOM lists those components.
Inherent risk is the risk before controls; residual risk is what remains after.
Control type (administrative, technical, physical) differs from control function (preventative, detective, responsive, corrective).

Decision rules

If the scenario says a vulnerability is being exploited, raise its priority above a higher CVSS score that has no exploitation evidence.
CVSS describes severity. EPSS estimates the likelihood of exploitation. Use both with asset value and context.
If a system cannot be patched, think exceptions and compensating controls, not “ignore it”.
Fragile systems, such as operational technology, call for careful, scheduled, gentle scanning.
After a fix, validate the remediation.
Risk strategies: accept, transfer, avoid, mitigate. Match the verb to the story.

Traps. Ranking by CVSS alone. Treating a scanner finding as true without checking for false positives. Forgetting scan planning factors such as scheduling and sensitivity.

Domain 3: Incident Response and Management (24%)

The order to remember: preparation, detection, analysis, containment, eradication, recovery, post-incident.

Confusable pairs

Cyber Kill Chain describes attack stages; MITRE ATT&CK catalogs adversary tactics and techniques; the Diamond Model links adversary, capability, infrastructure, and victim.
Containment stops the spread; eradication removes the cause; recovery restores service.
Tabletop exercises are discussion-based; simulations are hands-on.
Chain of custody tracks who held evidence; data integrity validation shows it did not change; preservation keeps it; legal hold forbids deleting it.

Decision rules

Preserve evidence before you wipe or rebuild.
Isolate before you investigate deeply when a host is spreading harm, but do not destroy volatile data without thought.
Severity depends on impact and scope, not on how scary the alert looks.
A timeline needs consistent time zones.
Release from isolation only after remediation is verified.
Root cause analysis leads to corrective actions.

Traps. Skipping a phase. Treating eradication as containment. Rebuilding first, asking questions later.

Domain 4: Reporting and Communication (16%)

Executives get a short summary, impact, and decisions needed. Engineers get the technical detail.
Inhibitors to remediation: contracts, governance, business interruption, degraded functionality, legacy systems, proprietary systems, patch availability.
Speed metrics: mean time to detect, respond, close, and remediate. Accuracy metrics: false-positive rate and true-positive rate. Workload: alert volume.
Post-incident reporting: after action report, lessons learned, root cause analysis.
A communication plan names who to inform: legal, public relations, regulators, law enforcement, customers.

Last-day checklist

[ ] Re-read your own notes on the pairs above, not new material.
[ ] Say the incident response phases aloud, in order.
[ ] Explain CVSS versus EPSS in one sentence.
[ ] Review the questions you missed in practice sets, and the reason each wrong option fails.
[ ] Check your ID and booking details, and read our exam day guide.
[ ] Plan your pace: a little under two minutes per question at 85 questions, with extra time for performance-based items.
[ ] Sleep.

More guides for CS0-004

Next step

Turn this sheet into recall by trying the sample questions, and read the domains explained page for the longer version. For timed sets, see our CS0-004 practice tests. Back to the CS0-004 overview.

Frequently asked questions

Is this enough to pass?

No. It is a review aid. Use the objectives, labs, and timed practice as your main preparation.

Should I memorize every tool?

Know what job each tool does and how to read its basic output.

Try these practice exams