Domain Runner

Format

• Exam CS0-004 (V4): up to 85 questions in 165 minutes.
• Passing score is 750 on a scale of 100 to 900.
• Multiple choice plus performance-based questions (PBQs): simulations where you read logs, tool output, or settings and act on them.
• You can flag questions and return to them. Many people skip the PBQs first and come back at the end.
• CompTIA recommends about 4 years as a SOC or vulnerability analyst.

Think like an analyst

• Read the evidence closely. Ports, timestamps, accounts, and process names tell the story.
• Follow the incident response order: contain before you eradicate, and preserve evidence as you go.
• Prioritize by risk, not CVSS alone: active exploitation, exposure, and asset value.
• Pick the least disruptive action that actually solves the problem.
• Communicate through the plan: legal, PR, and management each have a role.

Domain weights

Weights follow the CS0-004 (V4) exam objectives, document version 2.0. This build covers domains 1 and 2 (60% of the exam). Incident Response and Management (24%) and Reporting and Communication (16%) are not in the game yet. Check comptia.org for the current objectives before you book.