CySA+ performance-based questions: what they are and how to practise them

The exam behind the questions, by the numbers

CySA+ CS0-003 allows a maximum of 85 questions in 165 minutes, mixing multiple choice with performance-based questions, and is passed at 750 on a scale of 100 to 900. CompTIA recommends Network+ or Security+ knowledge plus a minimum of four years of hands-on experience as an incident response or SOC analyst. The four domains are weighted Security Operations 33%, Vulnerability Management 30%, Incident Response and Management 20%, and Reporting and Communication 17%.

The version matters for anyone booking now. CompTIA launched CS0-004 on 23 June 2026 and retires the English CS0-003 exam on 22 December 2026, with the Japanese, Portuguese and Spanish versions following on 23 March 2027. CS0-004 keeps the same ceiling of 85 questions, the same 165 minutes and the same 750 pass mark, but reweights the domains to Security Operations 34%, Vulnerability Management 26%, Incident Response and Management 24%, and Reporting and Communication 16%. If your exam date falls after the retirement date for your language, you are sitting CS0-004 whether or not your study material says so.

What a performance-based question is, in CompTIA’s own terms

CompTIA describes a performance-based question as one that tests your ability to perform a task or solve a problem using a simulated environment. Two details in that description decide how you should approach them. First, the simulation is deliberately limited: CompTIA states that the functionality is restricted so that there are several potential responses or pathways to complete it, which means you are not being asked to remember every menu of a real product, only to reach a defensible result. Second, scoring is not uniform. CompTIA says that some performance-based questions may offer partial credit while others may not, so an incomplete answer is sometimes worth something and sometimes worth nothing, and you will not know which from the question itself.

On CySA+ the task is almost always interpretive. Where a Security+ PBQ asks you to place a control, a CySA+ PBQ hands you material an analyst would actually receive during a shift and asks what it means and what to do. The domain objectives tell you what that material can be: log excerpts and alert detail from monitoring tools, vulnerability scan output that needs prioritising against the assets it names, indicators that have to be judged true or false positive, and incident timelines whose next step you have to choose. The question stem is short; the evidence is where the time goes.

Time: the arithmetic nobody does in advance

165 minutes across 85 questions is one minute and fifty-six seconds per item if every item took the same time. They do not. A multiple-choice item you know takes twenty seconds; a PBQ with three log sources can take ten minutes. The practical consequence is that the multiple-choice section is where you bank time, and the PBQs are where you spend it. Candidates who answer the PBQs first, slowly, in the order presented, then rush seventy multiple-choice items, lose marks on both ends.

A workable plan: mark every PBQ for review on first sight, note in a sentence what it is asking, and move on. Clear the multiple choice at a steady pace. Then return to the PBQs with the remaining time divided by how many there are, and treat that figure as a hard budget per question. Because partial credit is possible on some of them, a PBQ you have half completed when the budget runs out should be left in that state, not abandoned.

A four-pass method for any evidence-based question

Pass one: read the deliverable. Before looking at a single log line, find the sentence that says what you must produce: a host to isolate, an ordering of steps, a severity, a root cause. Everything else in the scenario is either relevant to that deliverable or a distraction, and you cannot tell which until you know the deliverable.

Pass two: inventory the evidence. List what you have been given and from where: which system generated it, over what time window, with what clock. Timestamps that disagree by a time zone and source types that overlap are the two most common traps, and both are invisible if you read the evidence as prose rather than as a set of sources.

Pass three: eliminate. For each candidate answer ask what in the evidence rules it out. Elimination is faster than confirmation on CySA+ because the exam writers choose distractors that are consistent with some of the evidence; only the correct answer is consistent with all of it.

Pass four: act by the harm rule. When the question asks for a next step, choose the action that produces information unless harm is ongoing, in which case choose the action that stops it. This single rule resolves most ordering questions: contain if something is still being damaged, collect if it is not, and never restore service before the cause is understood.

Where each domain turns into a task

Security Operations is the largest domain in both CS0-003 and CS0-004, and it is where log analysis lives. Expect to be shown output from more than one source and asked which event, host or account is the one that matters. The skill is correlation: matching an authentication record to a process event to a network connection, then saying which of them is the anomaly.

Vulnerability Management questions tend to give you scan results and context about the assets. The task is prioritisation, not identification: the scanner has already found the issues, and the exam wants to know which one you would fix first and why, given exposure, exploitability and what the system does. A critical finding on an isolated test box can rank below a medium one on an internet-facing server.

Incident Response and Management is where ordering questions appear. Given a situation partway through an incident, which step comes next, and which actions would destroy evidence or tip off an attacker if taken too early. Reporting and Communication is the smallest domain and the least likely to be simulated, but it still shapes answers elsewhere: several questions turn on who needs to be told, and when, rather than on a technical action.

The mistakes that cost the most marks

Forming a hypothesis before reading the evidence, then hunting for support. Treating a signed binary or a familiar tool name as proof of benign activity when the surrounding behaviour says otherwise. Choosing the most disruptive response because it feels decisive, when the question asked for the next step rather than the final one. Ignoring the time window stated in the scenario and reasoning about events outside it. And leaving a PBQ untouched because it looked long, which guarantees zero on a question that may have offered partial credit.

How CertSprint practice relates to the real thing

Nothing outside Pearson VUE reproduces CompTIA’s simulation environment, and no practice product should claim to. What can be practised is the reasoning the simulations grade: correlating evidence, prioritising findings and ordering a response. Our CySA+ bank uses matching and ordering tasks for that purpose, each with a full explanation of why the correct arrangement holds and why the plausible alternative does not. Use the domain scores to find the domain where your reasoning is slowest, because that is the domain where a timed PBQ will cost you most.

Frequently asked

Our CySA+ bank contains 32 PBQ-style exercises in two formats: matching tasks, where you pair each requirement to the capability that satisfies it, and ordering tasks, where you sequence the steps of a procedure. Each one carries the same full explanation as the multiple-choice questions, covering why the correct arrangement is right and why the plausible alternative is not.

These train the reasoning the exam tests — sequence, placement, and matching — rather than reproducing a vendor's simulation interface. Nothing here recreates the exam environment itself, and no practice product legitimately can.