EnglishDeutschFrançaisEspañolPortuguês

CompTIA · COMPTIA-CYSA

CompTIA CySA+ — Practice Questions and Mock Exam

Practice with realistic COMPTIA-CYSA questions aligned to the exam objectives. Alex explains every answer, and your readiness score shows what to study next.

Start practicing COMPTIA-CYSA freeBuy COMPTIA-CYSA access for $29.99
Buy COMPTIA-CYSA access for $29.99Start practicing COMPTIA-CYSA free

One payment. Lifetime access to this certification.

Try 5 questions first →
85Questions
165minTime Limit
750/ 900Pass Score

Checked against CompTIA · August 2026Current exam version

Overview

About the exam

CompTIA CySA+ (CS0-004) validates your ability to detect, analyze, and respond to cybersecurity threats. It covers security operations, vulnerability management, incident response and management, and reporting and communication. The V4 version launched on June 23, 2026 and is aimed at analysts with about four years in a SOC analyst or vulnerability analyst role.

Exam domains

What's on the exam

Security Operations carries more than a third of the exam at 34%, covering the architectural vocabulary of security monitoring, threat-intelligence platforms, and SIEM analysis. Vulnerability Management (26%) and Incident Response and Management (24%) split most of the remainder, testing scan interpretation and CVSS-based prioritization alongside the arc that runs from initial prep work to the post-incident debrief. Reporting and Communication closes the blueprint at 16%, the smallest domain but still worth more than one exam question in six.

The weighting favors analysts who can read and correlate signals over those who only know incident-response theory: more than half the exam (60%) sits in Security Operations and Vulnerability Management combined, both of which depend on interpreting tool output rather than recalling definitions. Reporting is compact, but candidates who treat it as an afterthought miss questions on translating findings into risk scorecards and executive summaries — a skill the exam tests directly, not as a footnote to the technical domains.

Exam blueprint: COMPTIA-CYSA

Security Operations34%

Build the architectural vocabulary security operations runs on, read network, host, application, and cloud signals for signs of compromise, work SIEM tools and threat-intelligence platforms to confirm what's happening, apply threat-hunting frameworks, streamline the team's processes through automation, and weigh where AI genuinely helps versus where it introduces new risk.

Vulnerability Management26%

Plan and execute vulnerability scans, interpret output from scanning and assessment tools, and prioritize and mitigate vulnerabilities using scoring systems like CVSS, alongside control types and risk management concepts.

Incident Response and Management24%

Apply attack methodology frameworks such as the Cyber Kill Chain and MITRE ATT&CK, follow the incident response lifecycle from preparation through post-incident review, and execute response techniques including playbooks, evidence handling, and root cause analysis.

Reporting and Communication16%

Communicate vulnerability management findings, risk scorecards, and remediation plans to stakeholders, and report on security operations and incidents through executive summaries, post-incident reviews, and metrics such as mean time to detect and respond.

Format

Exam format and question types

The CySA+ exam contains a maximum of 85 questions combining multiple-choice and performance-based questions. Performance-based questions are delivered as simulations or inside virtual environments; you can skip a simulation and come back to it, but a virtual-environment item has to be finished when you reach it. The exam lasts 165 minutes with a passing score of 750 on a scale of 100 to 900.

Question types: COMPTIA-CYSA

Multiple Choice70%

Pick the single best answer from four or five options — the exam's bread and butter.

Drag & Drop15%

Drag items into the right slot, group or order — it tests whether you can apply a concept, not just recognise it.

Multiple Response10%

More than one answer is correct and you need all of them; the question tells you how many to pick.

Performance-based5%

A small hands-on task in a simulated console instead of a question — you configure something and the result is what gets graded.

CompTIA confirms these question types — a percentage split is not published; the shares reflect our exam-aligned question pool.

Try it now

Try five COMPTIA-CYSA questions

Five questions straight from our CompTIA CySA+ pool. Answer one — Alex explains the why.

Reporting and Communication1 / 5

Which of the following regulatory frameworks specifically requires a Data Protection Officer (DPO) for organizations processing personal data at scale?

AlexFull explanation from Alex

GDPR's DPO requirement applies to organizations whose core activities involve systematic, regular monitoring of individuals at scale, or large-scale processing of special category data (health, biometric, genetic). The DPO must: advise on GDPR compliance, monitor data protection practices, serve as the contact for supervisory authorities, and operate independently within the organization. The DPO role is distinct from CISO (security-focused) and privacy officer (broader privacy management). DPO must have expert knowledge of data protection law and practices.

Sourceeur-lex.europa.eu

Vulnerability Management2 / 5

A security team needs to assess whether their organization would be impacted by a specific vulnerability (CVE-2025-9999) that affects a widely used library. Which tool would BEST help identify if the vulnerable library is present in the organization's software?

AlexFull explanation from Alex

Software Composition Analysis (SCA) tools (Snyk, Black Duck, Dependabot, OWASP Dependency-Check) scan application codebases and builds to inventory all third-party components and their versions, then cross-reference against vulnerability databases (NVD, GitHub Advisory). Combined with Software Bill of Materials (SBOM in CycloneDX or SPDX format), organizations can rapidly assess exposure to newly disclosed CVEs. Executive Order 14028 (May 2021) requires SBOM for software sold to the US government. SCA integrates into CI/CD pipelines for continuous monitoring.

Sourceowasp.org

Security Operations3 / 5

During memory forensics analysis using Volatility, an analyst runs the 'malfind' plugin and discovers a memory region in svchost.exe marked as PAGE_EXECUTE_READWRITE with no associated file on disk. What does this MOST likely indicate?

AlexFull explanation from Alex

Volatility memory forensics plugins for malware detection: malfind (detects injected code — PAGE_EXECUTE_READWRITE with no disk backing), pstree/pslist (process tree analysis for suspicious parent-child relationships), netscan (network connections), handles (open handles), dlllist (loaded DLLs), cmdline (process command lines), and filescan (file objects in memory). The malfind plugin specifically targets process injection by checking memory protection flags and VAD (Virtual Address Descriptor) tags. Legitimate code rarely needs PAGE_EXECUTE_READWRITE permission.

Sourcegithub.com

Incident Response and Management4 / 5

A security analyst receives an alert that a user's workstation is communicating with a known botnet C2 server. After initial triage, the analyst confirms the connection is active. According to the incident response process, what is the NEXT step?

AlexFull explanation from Alex

The IR process after confirmed C2 activity: (1) Contain — isolate the system via network quarantine VLAN, EDR isolation, or physical disconnection, (2) Preserve evidence — capture memory, network connections, running processes, (3) Investigate — determine initial access vector, check for lateral movement, identify other compromised systems, (4) Eradicate — remove malware and persistence mechanisms, (5) Recover — reimage if necessary, restore from clean backups, (6) Document — create incident report with timeline and IoCs.

Sourcecsrc.nist.gov

Reporting and Communication5 / 5

A security manager needs to present monthly security metrics to the executive leadership team. Which combination of metrics would be MOST effective for an executive audience?

AlexFull explanation from Alex

Security metrics for executive audiences must translate technical security operations into business-relevant insights about risk posture and operational effectiveness. Metrics like MTTD and MTTR measure how quickly the team detects and responds to threats, incident counts by severity show threat landscape trends, and patch compliance against SLAs demonstrates proactive risk management. These are actionable, trend-able, and tied to business outcomes — unlike raw technical metrics such as log volumes or signature counts.

Sourcecsrc.nist.gov

Question pool

365 questions, built like the exam

The COMPTIA-CYSA pool covers every exam domain and keeps growing with new questions. A mock exam asks 85 questions in one sitting, on the same 165-minute clock as the real thing.

Audit record: COMPTIA-CYSA

Spec check against CompTIAAugust 19, 2026

last verified against the official CompTIA source

Pass mark750 / 900

as published by CompTIA

Blueprint coverage15 official objectives

across 4 domains, from the official exam guide

Pool size365 questions

= 4 full practice exams of 85 questions each — never the same question twice

Canonically validated344 of 365

each verified against official CompTIA documentation — answer, options and explanation, source cited

Methodology openly documented.How questions are made →

Planning

Preparing for COMPTIA-CYSA

How long you'll need depends on how much hands-on experience you bring. The rest is set by the vendor: how the exam is delivered, how soon you can retake it, and how long the credential stays valid.

CySA+ is delivered at Pearson VUE testing centers and online with a proctor. The exam is available in English; CompTIA lists French, Japanese, Spanish, and Portuguese as coming soon. The certification is valid for three years and renews with 60 CEUs earned inside the cycle, or by passing the current version of the exam.

Your plan: COMPTIA-CYSA

Exam day & after

DeliveryPearson VUE (testing center or online proctoring)
Retake policyNo waiting period for first retake. After second failed attempt, 14-day waiting period required for each subsequent retake.
Stays valid3 years

CySA+ is valid for three years from the exam pass date. Renew by earning 60 continuing education units (CEUs) within the three-year cycle, by earning a qualifying higher-level certification, or by passing the current version of the CySA+ exam.

CE credits60
Official guideView on vendor site

Watch out

Common pitfalls

Performance-based questions consume time disproportionate to their count, so flag the skippable simulations early and return to them once the multiple-choice items are locked in. Vulnerability scanning and penetration testing get treated as interchangeable by candidates who haven't done both, and the same confusion shows up between SIEM correlation rules and raw log analysis — knowing what a tool flags automatically versus what an analyst has to piece together by hand. Reporting and Communication is worth only 16%, but incident response questions test the phases in strict order (preparation, detection, containment, eradication, recovery, lessons learned), and answers that skip a step read as wrong even when the technical content is right.

Watch list: COMPTIA-CYSA

  1. 01Severity vs. Priority

    Ranking remediation by CVSS score alone, when the exam expects how easily a flaw is exploited, whether it is being exploited in the wild, and how critical the asset is to outrank a raw number.

  2. 02Framework Mixups

    Mapping a scenario to the wrong attack-methodology framework — questions test whether the Kill Chain, Diamond Model, or ATT&CK is the right lens, not the frameworks' definitions.

  3. 03Control Classifications

    Mislabeling administrative, technical, and operational controls or their preventive, detective, and corrective functions in mitigation questions.

  4. 04Scan Configuration

    Overlooking how credentialed versus uncredentialed scans change what an analyst sees, and what an incomplete asset inventory does to coverage.

  5. 05Tool Output Reading

    Questions show raw output from CyberChef, packet captures, or DNS logs and expect the right tool-to-artifact match, not just the right tool name.

Pass-IT trains you on exactly these weak spots — adaptive & spaced →

Questions

Frequently asked questions

How long is the CompTIA CySA+ exam?

The CompTIA CySA+ exam has 85 questions and a 165-minute time limit.

What is the passing score for CompTIA CySA+?

You need 750 / 900 to pass the CompTIA CySA+ exam.

What are common mistakes on the CompTIA CySA+ exam?

Common pitfalls include: Severity vs. Priority, Framework Mixups, Control Classifications, Scan Configuration, Tool Output Reading. Focus study time on these areas to avoid losing points.

Which CySA+ domains carry the most marks?

Security operations is the dominant domain at 34%, then vulnerability management at 26% and incident response and management at 24%. Reporting and communication takes the remaining 16%. That last domain is the one analysts underestimate, and it is worth roughly one question in six.

Should you take Security+ before CySA+?

CompTIA states no formal prerequisite, so CySA+ can be booked directly. Security+ covers the baseline vocabulary that CySA+ assumes, which is why most people sit it first. If you already work a SOC shift, the baseline is already there and going straight to CySA+ saves a sitting.

How long is CySA+ valid?

Three years from the exam pass date. You renew with 60 continuing-education units inside that cycle, by earning a qualifying higher-level certification, or by passing the current version of the CySA+ exam again. Most people take the continuing-education route rather than resitting.

What happens if you fail CySA+?

The second attempt can be booked with no waiting period. After a second failure CompTIA requires 14 days before each further attempt.

What comes after CySA+?

SecurityX is the advanced CompTIA step for architecture and governance work, and PenTest+ is the sideways move if you want to be the attacker rather than the analyst. SecAI+ is the newer option when the SOC you work in is putting AI into the detection pipeline. All three also renew CySA+ when passed.

Pass-IT is an independent study tool, not affiliated with or endorsed by CompTIA; CompTIA and exam names are trademarks of their respective owners.

One certification. One payment.

Full COMPTIA-CYSA access

Get the full question pool for this certification. Alex explains every answer, and your readiness score shows what to work on next.

Buy COMPTIA-CYSA access for $29.99One payment. Lifetime access to this certification.
Take the free readiness check20 questions. No card. See what to study before you buy.

Reach 80% readiness and pass — or your money back.

How the score works →

Related certifications

CompTIA A+ Core 1CompTIA A+ Core 2CompTIA Cloud+CompTIA Data+All CompTIA certifications →