This is the mother of all transient tests. It tries to emulate what happens when lightning hits (near) the power network, and the energies involved are high. The capacitance of the energy storage capacitor is up to 20μF, 200,000 times bigger than the 100pF used in an ESD test. The test setup is not identical to the one shown in the figure ESD Test Generator, a few pulse-shaping components are added, but the basic principle is the same. See IEC 1000-4-5 for details of this test setup.
The surge test is performed only on power supply lines, so this is typically a power supply design issue. However, note that if the design is made to operate on DC power, powered from any approved DC power supply, the designer may still have to incorporate surge protectors on the DC input. The protection of a commercial power supply may be limited to only protecting the power supply itself, resulting in heavy surges on its DC output.
Don't get confused by the similarities between 4kV ESD testing, 4kV fast transient burst testing, and 4kV surge. The voltages are the same, but the energy behind them is totally different. Dropping a small rock on your foot may hurt, but you will still be able to walk. Dropping a large rock from the same height will most likely cause severe damage to your foot. Doing this 250 times per second will reduce your shoe size permanently. When the surge boulder falls, you'd rather be somewhere else.