CySA+ practice test: 499 questions with full explanations

Questions on the exam

85

Time allowed

165 minutes format →

Passing score

750 of 900 — vendor, checked September 4, 2026 detail →

Exam fee

$425 — vendor, checked September 5, 2026 detail →

499 practice test questions for CompTIA CySA+ CS0-003 (retires December 2026), grouped by exam domain. Every question below shows all four options, which one is correct, and why each of the other three is not — the wrong answers are where most candidates lose marks.

Not sure where you stand? Take the free 5-min CySA+ readiness check →

CySA+ exam format →  ·  CySA+ passing score →  · CySA+ exam cost →

Questions by domain

• Security Operations — 181 questions →
• Vulnerability Management — 132 questions →
• Incident Response Management — 114 questions →
• Reporting and Communication — 72 questions →

Sample questions

Credential stuffing: A security analyst reviews the following authentication log entries from the past hour: 1

1. Credential stuffing ✓

   Correct. Credential stuffing involves using a list of breached username/password pairs across many accounts from a single source. The pattern shows rapid sequential attempts across different usernames from the same IP, with an eventual success — consistent with automated credential stuffing tools.
2. Password spraying

   Incorrect. Password spraying uses one or a few common passwords tried against many accounts to avoid lockouts. The log does not show which passwords were attempted, but the sequential multi-account failures from a single IP with eventual success more strongly suggests credential stuffing using pre-obtained credentials.
3. Brute force attack

   Incorrect. A brute force attack targets a single account with many password attempts. Here, each attempt targets a different username, which rules out classical single-account brute force.
4. Kerberoasting

   Incorrect. Kerberoasting is an offline attack targeting Kerberos service tickets — it does not generate authentication failure logs of this type and is not associated with sequential login attempts against multiple accounts.

All 181 Security Operations questions →

CVE-A, because it is remotely exploitable with no: Which vulnerability should be patched FIRST?

1. CVE-A, because it is remotely exploitable with no authentication and has the highest CVSS score ✓

   Correct. CVE-A has the highest CVSS base score (9.8/Critical), is network-exploitable with no privileges or user interaction required, and fully compromises confidentiality, integrity, and availability. Combined with direct Internet exposure and no WAF, this presents the greatest immediate risk.
2. CVE-B, because it requires user interaction, making exploitation more realistic in a social engineering context

   Incorrect. While CVE-B requires user interaction (raising exploitability concerns via phishing), its CVSS score of 7.5 is significantly lower than CVE-A's 9.8. CVE-A requires zero prerequisites for exploitation against an Internet-facing server.
3. CVE-C, because network-adjacent vulnerabilities are frequently exploited in internal pivoting scenarios

   Incorrect. CVE-C requires an attacker to already be on an adjacent network segment, a constraint that significantly limits its exploitability compared to a remotely exploitable, unauthenticated critical vulnerability. CVE-A poses a more immediate risk.
4. CVE-D, because local access vulnerabilities on Internet-facing servers indicate a host has already been compromised

   Incorrect. CVE-D requires local access and has the lowest CVSS score. If local access were confirmed, it would be an incident response scenario, not a prioritization question. The unauthenticated, remotely exploitable CVE-A must be addressed first.

All 132 Vulnerability Management questions →

Contents of RAM: According to the order of volatility, which data source should be collected FIRST?

1. Contents of RAM (memory dump) ✓

   Correct. RAM (volatile memory) is the most volatile evidence source — it is completely lost when the system is powered off or rebooted. It contains running processes, network connections, encryption keys, and in-memory malware that may not exist on disk. It must be captured first.
2. Hard disk image

   Incorrect. The hard disk is non-volatile storage — its contents persist after power loss. While critical to collect, it is much less time-sensitive than RAM. Collecting the disk first would risk losing in-memory artifacts that may hold key forensic evidence.
3. System event logs stored in /var/log/

   Incorrect. Log files on disk are non-volatile and will persist after the system is powered off. They are important forensic artifacts but are lower priority than volatile memory in the collection sequence.
4. Network packet capture from the switch port

   Incorrect. Network captures are valuable for detecting active C2 or lateral movement, but they represent ongoing traffic — starting a capture can happen in parallel. The immediate priority on the live host is RAM, which will be destroyed if the machine is shut down or crashes.

All 114 Incident Response Management questions →

Present business risk exposure using risk-tiered groups: Which presentation approach BEST serves a board-level

1. Present business risk exposure using risk-tiered groups, estimated breach likelihood, and potential financial/regulatory impact — focus the discussion on the 12 Critical and 89 High findings ✓

   Correct. Board members require business-context framing: financial exposure, regulatory risk, and strategic impact. They do not need technical CVE details. Focusing on Critical and High findings with business impact language (potential cost of breach, compliance fines, reputational damage) provides actionable governance-level information.
2. Present the full list of 847 vulnerabilities with CVSS scores and CVE IDs to demonstrate the scope of the problem

   Incorrect. Presenting raw technical data to a board audience is ineffective and counterproductive. Boards make strategic decisions; they need business risk translation, not vulnerability databases. This approach typically results in information overload and loss of audience engagement.
3. Only present the 12 Critical vulnerabilities to maintain focus and avoid alarming the board with lower-priority items

   Incorrect. Omitting the 89 High vulnerabilities gives an incomplete risk picture. While selectivity is appropriate, a board needs to understand the full risk posture. The 89 High vulnerabilities represent significant risk and should be included in the presentation.
4. Delegate the presentation to the IT operations team, as board members are not equipped to understand security vulnerabilities

   Incorrect. Security analysts are responsible for translating technical findings into business language for leadership. Delegation does not fulfill the analyst's communication responsibility. The board does not need to understand technical details — the analyst's job is to translate them into terms the board can act on.

All 72 Reporting and Communication questions →

Create a suppression rule that excludes alerts originating: Which action BEST addresses this requirement?

1. Create a suppression rule that excludes alerts originating from the vulnerability scanner's IP during its scheduled scan window ✓

   Correct. A targeted suppression (allowlist) rule scoped to the scanner's source IP and time window eliminates known-benign alert sources without broadly reducing detection capability. This is the standard SIEM tuning approach for scheduled, known-good activity.
2. Increase the alert severity threshold so only Critical and High alerts are forwarded to analysts

   Incorrect. Raising the global severity threshold would suppress many legitimate medium-severity threats alongside the scanner noise, creating dangerous blind spots. The problem is specifically scanner-generated false positives, requiring a targeted fix.
3. Disable the SIEM rules that are generating the false positive alerts

   Incorrect. Disabling the rules entirely removes detection capability for genuine malicious activity that would trigger those same rules. Rules should be tuned, not disabled.
4. Reduce the vulnerability scan frequency to decrease alert volume

   Incorrect. Reducing scan frequency degrades vulnerability management coverage and is not a SIEM-level solution. The scan and the SIEM should be configured to work together through proper suppression, not by limiting security activity.

All 181 Security Operations questions →

Credentialed scans authenticate to the target and inspect: Which explanation BEST accounts for this difference

1. Credentialed scans authenticate to the target and inspect installed software versions, registry settings, and patch levels that are not visible externally ✓

   Correct. Credentialed scans log in to the target OS with administrative credentials and perform local checks (installed package versions, registry keys, configuration files). This reveals vulnerabilities in software that has no network-facing service — a non-credentialed scan can only see what is exposed over the network.
2. Non-credentialed scans use a slower scanning engine that misses vulnerabilities due to timeout errors

   Incorrect. The performance difference between scan types is not the cause of the detection gap. The fundamental difference is that non-credentialed scans are limited to network-observable information, regardless of scan speed.
3. Credentialed scans benefit from updated vulnerability signatures that are only released quarterly

   Incorrect. Vulnerability signature databases (NASL plugins, etc.) are typically updated continuously and applied to both scan types. The detection gap is structural, not a result of signature update frequency.
4. Non-credentialed scans intentionally suppress low-severity findings to reduce alert noise

   Incorrect. Non-credentialed scans do not selectively suppress findings by severity. The difference is in access — without credentials, the scanner cannot assess local software state regardless of the desired output.

All 132 Vulnerability Management questions →

Isolate the server at the network layer using firewall: Which containment action should the analyst recommend

1. Isolate the server at the network layer using firewall rules or VLAN reassignment to block C2 communication while keeping the server operational ✓

   Correct. Network isolation blocks the C2 channel, preventing encryption trigger commands from reaching the ransomware while keeping the server operational for patient care. This directly addresses the constraint (cannot take offline) and the immediate threat (C2 communication enabling encryption).
2. Immediately shut down the server to prevent the ransomware encryption payload from executing

   Incorrect. Immediate shutdown violates the stated constraint — the server is required for patient care with a 4-hour RTO. Additionally, some ransomware variants trigger encryption on shutdown. Shutdown should only occur after failover is in place.
3. Run a full antivirus scan to remove the ransomware before it executes its payload

   Incorrect. AV scans are investigative and may not successfully remove the ransomware before it executes. The immediate priority is blocking the C2 channel that can trigger the encryption payload, not attempting removal while the server remains connected.
4. Take a full disk image of the server for forensic purposes before taking any containment action

   Incorrect. Evidence preservation is important but should not delay containment when the threat is active and imminent. A full disk image takes significant time, during which the ransomware could receive its encryption trigger. Containment (network isolation) comes before extended evidence collection.

All 114 Incident Response Management questions →

Mean time to remediate by severity: Which set of KPIs is BEST?

1. Mean time to remediate (MTTR) by severity, percentage of Critical/High findings remediated within SLA, and reduction in attack surface over time ✓

   Correct. These three KPIs measure outcomes (risk reduction) and operational effectiveness (remediation speed and SLA compliance). They are outcome-focused metrics executives can interpret as indicators of program maturity and risk posture improvement.
2. Number of scans run per week, number of CVEs identified, and number of vulnerability reports produced

   Incorrect. These are activity metrics (inputs), not effectiveness metrics (outcomes). Scanning frequently and finding many CVEs does not indicate the organization is remediating them or reducing risk. Executive leadership needs to understand risk outcomes, not scan volumes.
3. Number of analysts on the vulnerability management team, budget spent on scanning tools, and number of systems in scope

   Incorrect. These are resource/input metrics, not performance metrics. They describe program scale, not program effectiveness. A large team with high budget that remediates nothing is not effective.
4. CVSS score distribution, number of zero-day vulnerabilities identified, and number of vendor advisories reviewed

   Incorrect. CVSS distribution describes the vulnerability landscape, not remediation effectiveness. Zero-days identified and advisories reviewed are valuable operational activities but do not measure program outcomes (remediation rate, risk reduction).

All 72 Reporting and Communication questions →

CySA+ exam: the facts

How many questions are on the CySA+ exam?

85, as published by the exam vendor.

How long is the CySA+ exam?

165 minutes. Across 85 questions that is about 116 seconds per question.

What topics does the CySA+ exam cover?

4 domains: Security Operations, Vulnerability Management, Incident Response Management, Reporting and Communication. Weights: Security Operations 0.33%, Vulnerability Management 0.3%, Incident Response Management 0.2%, Reporting and Communication 0.17%.

How many CySA+ practice test questions does Certsqill have?

499, spread across 4 exam domains. Every one shows all options, which is correct, and why each of the others is not.