Free tool · No sign-up needed
5 free, original PBQs for CySA+ (CS0-003 and CS0-004), with the Linux command line and drag-and-drop. Do each task, check it, and read why the answer is right.
Last updated
CompTIA CySA+
You do each task instead of picking an answer. Every question is explained after you check it, and you get a score at the end.
Take it further in OpenpassAI
OpenpassAI’s practice sessions add performance-based questions, with command-line and network topology tasks, to full timed exams, AI explanations and a readiness score.
The questions
Each one with its scenario and task. Try it above first, then open the explanation.
Question 1 · Linux command line · Security Operations
The intrusion detection system flagged unusual requests to the company website this morning. You have a shell on the web server, and the access log is /var/log/nginx/access.log. Each line starts with the visitor’s address, and the status code follows the quoted request.
Work out who was probing the site and what they got, then block them.
Counting requests by address shows one visitor far ahead of the rest, and its requests are for paths the site doesn’t have (/admin, /.env, /backup.zip): a scanner looking for something left exposed. Most of them got 404, but the request with ../ in it climbed out of the download folder and got a 200, so the server handed over /etc/passwd. That is a path traversal vulnerability to report, as well as an address to block.
Question 2 · Ordering · Vulnerability Management
This week’s scan produced five findings, and the patching team can only start one today. You’re asked to rank them using severity, exposure and whether the flaw is being exploited.
Arrange the findings from the first to fix to the last.
The score is only one input. The VPN gateway comes first because it is critical, reachable from the internet and already being exploited in the wild. The customer portal is next: internet-facing and high severity, though not yet exploited. The file server flaw is serious but needs a local account, so an attacker must already be inside. The wiki finding is low severity on an internal system, and the informational finding on an isolated lab printer can wait for routine maintenance.
Question 3 · Ordering · Incident Response and Management
A server is believed to be compromised and is still running. You’re about to collect evidence, and the data that disappears soonest has to be captured first.
Arrange the evidence from the first to collect to the last.
Evidence is collected from the shortest-lived to the longest-lived. The processor’s cache and registers change every instant. Memory, with the running processes and network connections, is lost at power-off. Swap space and temporary files are overwritten as the system runs. Files on disk persist, logs already sent to another server are safer still, and backups on archival media change least of all.
Question 4 · Sorting · Security Operations
You’re tuning the detection rules in the SIEM. To measure how well they work, each of last week’s cases has to be classified by whether an alert fired and whether an attack was really happening.
Put each case under the outcome it is.
A true positive is an alert on a real attack, and a true negative is no alert on harmless activity: both are the system working. A false positive is an alert on something harmless, which wastes analysts’ time and teaches them to ignore alerts. A false negative is a real attack with no alert, which is the most dangerous outcome because nobody knows to respond.
Question 5 · Matching · Reporting and Communication
You’re preparing the quarterly security report for the board and the operations team, and each section relies on one of these terms.
Match each description to the term it defines.
Mean time to detect measures how long incidents go unnoticed. Mean time to respond measures how quickly the team acts once it knows, and mean time to remediate measures how long until the problem is fully fixed. Alert volume shows the workload and whether tuning is needed. The executive summary is the short, non-technical opening written for leaders who won’t read the detail.
CompTIA lists CySA+ among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. CompTIA’s page on performance-based questions, read on November 12, 2026.
Guide
CompTIA describes performance-based questions as exam items that test your ability to solve problems in real-world settings. Most are simulations: an approximation of a tool such as a firewall, a network diagram, a terminal window or an operating system.
You don’t pick an answer. You do the task, and there can be more than one correct way to do it.
Try each question cold. Getting it wrong first and then reading why teaches more than reading the answer and nodding along.
A right answer reached by guessing is a wrong answer waiting for exam day. Every question here explains why each part is what it is.
CompTIA says a simulation question can be skipped and returned to later, with your work saved. If one is eating your time, move on, answer the multiple-choice questions and come back.
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the toolFAQs
Find quick answers or contact our support team.
Yes. CompTIA lists CySA+ among its certifications with simulation performance-based questions: tasks in an approximation of a real tool, such as a firewall, a network diagram or a terminal window. That is from CompTIA’s page on performance-based questions, read on November 12, 2026.
No. They’re original tasks written to each exam’s published objectives. Using leaked real exam questions breaks every vendor’s exam rules.
CompTIA says a performance-based question can have more than one correct way through it, that its scoring allows for the different approaches, and that partial credit may be given. Here, each question is scored by its parts, so you can see which part you missed.
CompTIA says a simulation question can be skipped and returned to later, and that your work on it is saved when you move on. A virtual-environment question has to be completed when you reach it: a warning screen tells you so first.
No. It’s a practice terminal that runs in your browser. It understands the real commands the task needs and answers the way the real system would, but it isn’t a full operating system: nothing is installed, and nothing you type can break anything.
No. The questions run in your browser and nothing is saved. Sign up only if you want full practice exams and progress tracking.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
