CySA+ performance-based questions

What a PBQ is on this exam

Multiple choice, multiple response, and performance-based questions. The performance-based items drop you into a simulated console, network diagram, or configuration screen and score what you actually do.

CompTIA, CySA+ exam details ↗

Ours are written from the published objectives, never from anyone’s memory of a live exam. What follows is what each shape asks you to do.

The four shapes

• Matching

  4 tasks

  Pair each item with the one that fits it, from a pool holding more options than slots, so the last pair cannot fall out by elimination.

• Sorting

  3 tasks

  Drop each item into the category it belongs to. Several items per category, so knowing one does not give you the rest.

• Sequencing

  3 tasks

  Put steps in the order a process actually runs. Getting the steps right and the order wrong scores the way it does on the exam, which is partly.

• Log and output analysis

  2 tasks

  Read a log extract, a config, or a network diagram, and answer what it shows. The artifact is on screen and the answer is in it.

Every task is scored slot by slot, so a sequence with two steps out of place is not marked the same as one with none right. Partial credit is how the real exam scores these, and a practice set that marks them all-or-nothing tells you less than the number it prints.

Coverage against the published blueprint

CompTIA publishes the weight of each domain. The set is written to those weights rather than to whichever domain is easiest to build a task from, which is the difference between a sample of the exam and a pile of exercises.

• Security Operations4 tasks · 33% of the exam
• Vulnerability Management4 tasks · 30% of the exam
• Incident Response and Management2 tasks · 20% of the exam
• Reporting and Communication2 tasks · 17% of the exam

What each answer rests on

Every task carries the page its answer was checked against, and the link is in the walkthrough where you can open it. Here they are up front, so you can check us before starting rather than after.

• NIST3 pages · 4 tasks
• first.org2 pages · 3 tasks
• MITRE ATT&CK2 pages · 3 tasks
• man7.org1 page · 1 task
• OWASP1 page · 1 task

• FIRST, CVSS v3.1 specification2 tasks
• MITRE ATT&CK, Enterprise tactics2 tasks
• NIST SP 800-61 Rev. 2, Computer Security Incident Handling Guide2 tasks
• FIRST, Traffic Light Protocol version 2.01 task
• man7.org, tcpdump(8)1 task
• MITRE ATT&CK, T1110.003 Password Spraying1 task
• NIST SP 800-115, Technical Guide to Information Security Testing1 task
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning1 task
• OWASP, SQL Injection Prevention Cheat Sheet1 task

Every source behind the CS0-003 question bank