CS0-004 study plan

Your step-by-step plan

1. Confirm you are studying V4 and set a date

   Day 1

   CS0-004 is the current exam and CS0-003 retires on 22 December 2026, so make sure your materials are V4. Read the official exam objectives and the four domains with their weights, then book a provisional date. A fixed date turns open-ended study into a plan and is the single biggest predictor of actually sitting the exam.

2. Build the security operations foundation

   Weeks 1-2

   Security operations is the largest domain and underpins the rest. Learn the monitored architecture and its logging, and build the source-by-source table of what each detection source can and cannot prove. Cover threat intelligence, threat hunting, SOAR, and the use of AI in the SOC. Practise reading log and telemetry excerpts and stating what they demonstrate.

3. Master vulnerability prioritisation, not just scanning

   Weeks 2-3

   Learn to run and read scans, then spend the bulk of your time on prioritisation. Drill ranking two findings using exploitability, threat intelligence, asset criticality, and compensating controls rather than the CVSS number alone. Practise spotting false positives and saying how you would confirm them.

4. Lock the incident response lifecycle order

   Weeks 3-4

   Commit the lifecycle phases to memory and rehearse them against scenarios: contain, then eradicate, then recover, then lessons learned. Learn what MITRE ATT&CK, the Cyber Kill Chain, and the Diamond Model are each for, and practise placing an action at its correct phase and spotting the premature-action distractor.

5. Practise reporting and stakeholder communication

   Week 4

   Cover vulnerability and incident reporting and the metrics and KPIs that belong in each. Practise pitching the same finding to an executive, a technical team, and a regulator. This domain is smaller but the questions are reliable marks once you match message to audience.

6. Drill scenarios and performance-based tasks

   Week 5

   Move to full practice sets, including performance-based questions, and read the explanation for every item, including those you got right. The exam tests analyst judgement between plausible options, so understanding why a distractor is the wrong next action is where the marks are.

7. Sit a timed mock, then close weak domains

   Week 6

   Take at least one full timed mock to rehearse pacing and the flag-and-return habit. Use your per-domain accuracy to drill the two weakest domains rather than re-reading what you already know, and repeat until every domain clears the pass line with margin on unseen questions.

Frequently asked questions