Home Certifications FAQ Partners Blog

·EN·DE·FR·ES·PT

CompTIA · COMPTIA-CYSA

CompTIA CySA+ — Practice Questions and Mock Exam

Prepare for COMPTIA-CYSA with original practice questions and clear answer explanations. Ask Alex, your AI tutor, when you need more detail, use your results to identify topics to review, and practice your pacing with timed mock exams.

Start practicing COMPTIA-CYSA free Buy COMPTIA-CYSA access for $29.99

Buy COMPTIA-CYSA access for $29.99 Start practicing COMPTIA-CYSA free

85Mock exam questions

165minTime limit

750/ 900Passing score

Checked against CompTIA · August 2026 · Current exam version

Overview

About the exam

CompTIA CySA+ (CS0-004) validates your ability to detect, analyze, and respond to cybersecurity threats. It covers security operations, vulnerability management, incident response and management, and reporting and communication. The V4 version launched on June 23, 2026 and is aimed at analysts with about four years in a SOC analyst or vulnerability analyst role.

Try the practice preview

Try five COMPTIA-CYSA questions

Try five practice questions from the app’s current CompTIA CySA+ question bank, with answers and explanations.

Reporting and Communication1 / 5

Which of the following regulatory frameworks specifically requires a Data Protection Officer (DPO) for organizations processing personal data at scale?

AlexFull explanation from Alex

GDPR's DPO requirement applies to organizations whose core activities involve systematic, regular monitoring of individuals at scale, or large-scale processing of special category data (health, biometric, genetic). The DPO must: advise on GDPR compliance, monitor data protection practices, serve as the contact for supervisory authorities, and operate independently within the organization. The DPO role is distinct from CISO (security-focused) and privacy officer (broader privacy management). DPO must have expert knowledge of data protection law and practices.

Sourceeur-lex.europa.eu

Vulnerability Management2 / 5

A security team needs to assess whether their organization would be impacted by a specific vulnerability (CVE-2025-9999) that affects a widely used library. Which tool would BEST help identify if the vulnerable library is present in the organization's software?

AlexFull explanation from Alex

Software Composition Analysis (SCA) tools (Snyk, Black Duck, Dependabot, OWASP Dependency-Check) scan application codebases and builds to inventory all third-party components and their versions, then cross-reference against vulnerability databases (NVD, GitHub Advisory). Combined with Software Bill of Materials (SBOM in CycloneDX or SPDX format), organizations can rapidly assess exposure to newly disclosed CVEs. Executive Order 14028 (May 2021) requires SBOM for software sold to the US government. SCA integrates into CI/CD pipelines for continuous monitoring.

Sourceowasp.org

Security Operations3 / 5

During memory forensics analysis using Volatility, an analyst runs the 'malfind' plugin and discovers a memory region in svchost.exe marked as PAGE_EXECUTE_READWRITE with no associated file on disk. What does this MOST likely indicate?

AlexFull explanation from Alex

Volatility memory forensics plugins for malware detection: malfind (detects injected code — PAGE_EXECUTE_READWRITE with no disk backing), pstree/pslist (process tree analysis for suspicious parent-child relationships), netscan (network connections), handles (open handles), dlllist (loaded DLLs), cmdline (process command lines), and filescan (file objects in memory). The malfind plugin specifically targets process injection by checking memory protection flags and VAD (Virtual Address Descriptor) tags. Legitimate code rarely needs PAGE_EXECUTE_READWRITE permission.

Sourcegithub.com

Incident Response and Management4 / 5

A security analyst receives an alert that a user's workstation is communicating with a known botnet C2 server. After initial triage, the analyst confirms the connection is active. According to the incident response process, what is the NEXT step?

AlexFull explanation from Alex

The IR process after confirmed C2 activity: (1) Contain — isolate the system via network quarantine VLAN, EDR isolation, or physical disconnection, (2) Preserve evidence — capture memory, network connections, running processes, (3) Investigate — determine initial access vector, check for lateral movement, identify other compromised systems, (4) Eradicate — remove malware and persistence mechanisms, (5) Recover — reimage if necessary, restore from clean backups, (6) Document — create incident report with timeline and IoCs.

Sourcecsrc.nist.gov

Reporting and Communication5 / 5

A security manager needs to present monthly security metrics to the executive leadership team. Which combination of metrics would be MOST effective for an executive audience?

AlexFull explanation from Alex

Security metrics for executive audiences must translate technical security operations into business-relevant insights about risk posture and operational effectiveness. Metrics like MTTD and MTTR measure how quickly the team detects and responds to threats, incident counts by severity show threat landscape trends, and patch compliance against SLAs demonstrates proactive risk management. These are actionable, trend-able, and tied to business outcomes — unlike raw technical metrics such as log volumes or signature counts.

Sourcecsrc.nist.gov

Create a free account

Question pool

365 practice questions

Use the Pass-IT question pool to practice for COMPTIA-CYSA. Mock exams are set to 85 questions in 165 minutes.

Pool details: COMPTIA-CYSA

Exam details checked against CompTIAAugust 19, 2026

date of the last check against the official CompTIA source

Passing score750 / 900

as published by CompTIA

Objectives in the guide15 objectives listed in the official guide

across 4 domains in the official exam guide

Pool size365 questions

= The pool size is equivalent to 4 sets of 85 questions; this does not mean that each mock exam uses a separate set.

Recorded as checked against sources344 of 365

questions recorded as having their answer, options, and explanation checked against official CompTIA documentation

How questions are made →

Exam domains

What's on the exam

Security Operations carries more than a third of the exam at 34%, covering the architectural vocabulary of security monitoring, threat-intelligence platforms, and SIEM analysis. Vulnerability Management (26%) and Incident Response and Management (24%) split most of the remainder, testing scan interpretation and CVSS-based prioritization alongside the arc that runs from initial prep work to the post-incident debrief. Reporting and Communication closes the blueprint at 16%, the smallest domain but still worth more than one exam question in six.

The weighting favors analysts who can read and correlate signals over those who only know incident-response theory: more than half the exam (60%) sits in Security Operations and Vulnerability Management combined, both of which depend on interpreting tool output rather than recalling definitions. Reporting is compact, but candidates who treat it as an afterthought miss questions on translating findings into risk scorecards and executive summaries — a skill the exam tests directly, not as a footnote to the technical domains.

Exam blueprint: COMPTIA-CYSA

Security Operations34%

Build the architectural vocabulary security operations runs on, read network, host, application, and cloud signals for signs of compromise, work SIEM tools and threat-intelligence platforms to confirm what's happening, apply threat-hunting frameworks, streamline the team's processes through automation, and weigh where AI genuinely helps versus where it introduces new risk.

Vulnerability Management26%

Plan and execute vulnerability scans, interpret output from scanning and assessment tools, and prioritize and mitigate vulnerabilities using scoring systems like CVSS, alongside control types and risk management concepts.

Incident Response and Management24%

Apply attack methodology frameworks such as the Cyber Kill Chain and MITRE ATT&CK, follow the incident response lifecycle from preparation through post-incident review, and execute response techniques including playbooks, evidence handling, and root cause analysis.

Reporting and Communication16%

Communicate vulnerability management findings, risk scorecards, and remediation plans to stakeholders, and report on security operations and incidents through executive summaries, post-incident reviews, and metrics such as mean time to detect and respond.

Format

Exam format and question types

The CySA+ exam contains a maximum of 85 questions combining multiple-choice and performance-based questions. Performance-based questions are delivered as simulations or inside virtual environments; you can skip a simulation and come back to it, but a virtual-environment item has to be finished when you reach it. The exam lasts 165 minutes with a passing score of 750 on a scale of 100 to 900.

Question types: COMPTIA-CYSA

Multiple Choice70%

Select the single answer that best meets the question’s requirements.

Drag & Drop15%

Move items into the slots, groups, or sequence specified by the task.

Multiple Response10%

Select multiple answers. Follow the question’s instructions on how many to choose.

Performance-based5%

Complete a practical task in a simulated environment, following the stated requirements.

See CompTIA for official question-format information. The shares shown describe the Pass-IT practice pool; they do not establish the proportions on the official exam.

Planning

Preparing for COMPTIA-CYSA

CySA+ is delivered at Pearson VUE testing centers and online with a proctor. The exam is available in English; CompTIA lists French, Japanese, Spanish, and Portuguese as coming soon. The certification is valid for three years and renews with 60 CEUs earned inside the cycle, or by passing the current version of the exam.

Preparation and logistics: COMPTIA-CYSA

Taking and maintaining the certification

DeliveryPearson VUE (testing center or online proctoring)

Retake policyNo waiting period for first retake. After second failed attempt, 14-day waiting period required for each subsequent retake.

Certification validity3 years

CySA+ is valid for three years from the exam pass date. Renew by earning 60 continuing education units (CEUs) within the three-year cycle, by earning a qualifying higher-level certification, or by passing the current version of the CySA+ exam.

Continuing education credits60

Official guideView on provider site

Study notes

Common pitfalls

Topics to review: COMPTIA-CYSA

01Severity vs. Priority
Ranking remediation by CVSS score alone, when the exam expects how easily a flaw is exploited, whether it is being exploited in the wild, and how critical the asset is to outrank a raw number.
02Framework Mixups
Mapping a scenario to the wrong attack-methodology framework — questions test whether the Kill Chain, Diamond Model, or ATT&CK is the right lens, not the frameworks' definitions.
03Control Classifications
Mislabeling administrative, technical, and operational controls or their preventive, detective, and corrective functions in mitigation questions.
04Scan Configuration
Overlooking how credentialed versus uncredentialed scans change what an analyst sees, and what an incomplete asset inventory does to coverage.
05Tool Output Reading
Questions show raw output from CyberChef, packet captures, or DNS logs and expect the right tool-to-artifact match, not just the right tool name.

Practice with questions and explanations in Pass-IT →

Questions

Frequently asked questions

How long is the CompTIA CySA+ exam?

The CompTIA CySA+ exam has 85 questions and a 165-minute time limit.

What is the passing score for CompTIA CySA+?

The passing score for the CompTIA CySA+ exam is 750 / 900.

Which pitfalls should I review when preparing for CompTIA CySA+?

Topics to review include Severity vs. Priority, Framework Mixups, Control Classifications, Scan Configuration, Tool Output Reading. Work through examples to check that you understand the distinctions and can explain your answer.

Which CySA+ domains carry the most marks?

Security operations is the dominant domain at 34%, then vulnerability management at 26% and incident response and management at 24%. Reporting and communication takes the remaining 16%. That last domain is the one analysts underestimate, and it is worth roughly one question in six.

Should you take Security+ before CySA+?

CompTIA states no formal prerequisite, so CySA+ can be booked directly. Security+ covers the baseline vocabulary that CySA+ assumes, which is why most people sit it first. If you already work a SOC shift, the baseline is already there and going straight to CySA+ saves a sitting.

How long is CySA+ valid?

Three years from the exam pass date. You renew with 60 continuing-education units inside that cycle, by earning a qualifying higher-level certification, or by passing the current version of the CySA+ exam again. Most people take the continuing-education route rather than resitting.

What happens if you fail CySA+?

The second attempt can be booked with no waiting period. After a second failure CompTIA requires 14 days before each further attempt.

What comes after CySA+?

SecurityX is the advanced CompTIA step for architecture and governance work, and PenTest+ is the sideways move if you want to be the attacker rather than the analyst. SecAI+ is the newer option when the SOC you work in is putting AI into the detection pipeline. All three also renew CySA+ when passed.

One certification, 12 months

Practice for COMPTIA-CYSA

Focus your practice on one certification, or choose Pro to practice across all certifications.

Buy COMPTIA-CYSA access for $29.99

Start a free practice sessionTry the first 20 questions without a card to see whether the practice suits you.

For eligible purchases: money-back guarantee if you fail your exam.

View guarantee terms →