CySA+ Readiness Test

10 questions, balanced across the exam's topics. Answer each one, then submit for your practice readiness estimate and per-topic breakdown. This is a practice estimate — not a prediction or guarantee of your official exam result.

Question 1

Incident communications: executives want hourly updates. How should this be handled?

engage the vendor through the proper channel with evidence, not accusations refer to the designated spokesperson; confirm nothing beyond the approved holding statement provide verified facts through legal; never speculate establish a regular briefing cadence with the incident commander

Question 2

Advanced hunt — adversary profile: an insider working with an external group. Which is the BEST answer?

correlate unusual internal access with external infrastructure from intel reimage a random workstation run a standard vulnerability scan wait for an automated alert to fire

Question 3

Intelligence describes this activity: a disgruntled employee exfiltrating customer data. Which threat actor type best fits?

an advanced persistent threat (APT) cybercriminals an insider threat hacktivists

Question 4

A scan flags CVE-2026-1033: a critical SQL injection in the customer portal (CVSS 9.1). Where should the analyst look for authoritative details and the CVSS score?

the vendor's marketing brochure an anonymous forum rumor the National Vulnerability Database (NVD) a social media post

Question 5

Architecture weakness: one firewall rule base nobody understands. Which redesign BEST fixes it?

rebuild with documented, reviewed, least-privilege rules multi-region design for critical workloads with tested failover adopt zero-trust network access with per-app policy virtual desktops with no local data persistence

Question 6

Incident: web shell found on the public web server. What containment step should come first?

isolate the server from the network immediately take the site offline or isolate the server, then remove the shell suspend the account and preserve mailbox evidence isolate the DC and fail over to a clean one per the DR plan

Question 7

An investigation stalls because no endpoint telemetry exists for the affected servers. What is the BEST systemic fix?

blame the SIEM vendor increase alert volume identify the missing log source (e.g., no EDR on servers) and close the visibility gap declare the investigation complete

Question 8

APT campaign analysis: three intrusions share TTPs but use different malware. Which is the BEST answer?

archive the intel and forget it treat each intrusion as unrelated attribute based on one weak indicator assess as one actor with tooling diversity — track behavior, not just hashes

Question 9

Gap review at Northwind Retail: a vulnerability with no owner was found on FW-EDGE-01 (finding #56). What is the BEST remediation?

ignore the finding assign ownership in the asset inventory document it and take no action buy an unrelated tool

Question 10

Network access scenario: contractor laptops on the production floor. Which NAC design is the best fit?

time-bound NAC policies scoped to required resources NAC health checks quarantining non-compliant devices NAC profiling with MAB for headless devices quarantine VLAN with remediation instructions

Unanswered questions count as incorrect. Your answers are graded on the server; no answer key is sent to your browser.

← Back to the CySA+ page

About Contact Privacy Policy Terms of Service Refund Policy

Home Exams Simulations WorkTrials GameScope Account