Practice questions for the CompTIA CySA+ exam objectives
CySA+ CS0-004Domain 1 · Security Operations
A threat intelligence analyst at an MSP is documenting an intrusion with the Diamond Model. The team knows the malware family (a modified Cobalt Strike beacon) and the victim (a regional accounting client). They have not identified who is behind it or where the command servers are. Which Diamond Model vertices remain to be filled in, and which pivot is available first?
ConfidenceI think so
2 / 3
Practice and timed mocks are free, with right or wrong on every answer and your total score.
About this CompTIA CySA+ practice test
This free CompTIA CySA+ practice test has 40 original questions written from the outline of the CompTIA. The real exam has 85 questions and a limit of 2 hours 45 minutes. Practice shows right or wrong on every answer; the full analysis, $39 once, adds each explanation and source. Bank checked 2026-05-22.
These three are published in full. For every other question, practice shows right or wrong and the full analysis adds the answer.
Sample question 1: Reporting and Communication
A public US-listed company discovers a material cybersecurity incident on a Tuesday. Per SEC Item 1.05 of Form 8-K (effective December 2023), what is the disclosure deadline?
Within 24 hours
Within four business days of determining the incident is material
Within 30 days
Within 72 hours per GDPR
Answer: B. SEC Item 1.05 of Form 8-K (released July 2023, effective December 2023) requires disclosure within four business days of the determination that an incident is material. The trigger is materiality determination, not incident discovery. GDPR Article 33's 72-hour rule applies to data-protection-authority notification, not US SEC investor disclosure.
A vulnerability scanner reports 5,000 findings. The team has bandwidth to remediate 50 per week. They want to weight by likelihood of exploitation in the next 30 days. Which scoring system is purpose-built for that?
CVSS base score
EPSS (Exploit Prediction Scoring System) maintained by FIRST
CWE Top 25
CWSS (Common Weakness Scoring System)
Answer: B. EPSS is the FIRST-maintained model that estimates the probability a CVE will be exploited in the next 30 days. CVSS scores severity, not exploitation likelihood. CWE Top 25 ranks weakness classes, not specific CVEs. CWSS scores weakness severity at the CWE level. The CySA+ exam tests this distinction explicitly.
A SOC analyst reviews EDR telemetry and sees a PowerShell process spawned by Microsoft Word, then a network connection to an unfamiliar external IP. Which MITRE ATT&CK technique best describes the initial pattern?
T1078 Valid Accounts
T1059.001 Command and Scripting Interpreter: PowerShell, often invoked via T1566 Phishing or T1137 Office Application Startup
T1490 Inhibit System Recovery
T1003 OS Credential Dumping
Answer: B. Word spawning PowerShell with network egress is the canonical macro-or-template-exploit pattern. T1059.001 (PowerShell execution) is the named child technique; the parent chain typically involves T1566 (phishing) or T1137 (Office startup). Valid Accounts, Inhibit System Recovery, and Credential Dumping are different tactics and do not fit the observed signal.
The questions are drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each one cites. A licensed professional has not reviewed them unless this page says so. See the AI disclosure.
Who stands behind this page
Accountable editor
Julian Calvo, Ed.D., founder. Ed.D. in Learning Sciences (University of Miami), MBA (Lynn University), Master's in Organizational Learning and Leadership (Barry University). His credentials are in learning sciences and assessment design, not in the field this exam covers.
Licensed professional review
None on record. No licensed professional has reviewed this question bank. It is drafted with AI and checked against its cited sources by the DecipherU item team.
How the questions are made
Drafted with AI (Anthropic's Claude) from the official outline and primary sources, then checked against the source each question cites by the DecipherU item team. Julian Calvo designed this method. No real exam content is used. Read the AI disclosure and the methodology.
What this bank shows
40 live questions; 40 cite at least one primary source. None carries a scheduled re-check date.