CySA+ CS0-004 PBQ examples and free practice

What a CySA+ CS0-004 PBQ actually asks for

CySA+ is an analyst exam, so the PBQs read like a shift: an alert queue, a log with one true positive in it, and a containment decision you have to justify.

A performance-based question is a task, not a question with options: you are handed a workspace and a deliverable, and the scoring reads the state you leave behind. On CS0-004 the bank carries 35 authored scenarios across 6 formats, and a simulated sitting serves 5 of them alongside the multiple-choice section.

The formats below are the ones this exam uses. Classification bins is the format in the free scenario further down this page, so you can try the interaction before you decide whether CySA+ CS0-004 is the right exam for you.

How PBQs are graded

Every scenario is scored item by item, and the total is points earned over points available. There is no penalty for a wrong item beyond the point it was worth, and no bonus for speed: the clock decides when you stop, not how much each item is worth. A blank row and a wrong row score the same, which is why leaving a workspace half-finished is the most expensive habit on this exam.

The score report lists each item, the value you gave and the value required. On CS0-004 a sorting item is one point, a log origin can be worth two, and a ranked field pays half when at least half the sequence is right. Partial credit is why a half-finished scenario still tells you something: it shows which line of the deliverable you actually understood.

The pass mark is 750 on the 100 to 900 scale. CompTIA and Cisco do not publish how many PBQ points that represents, and anyone who quotes an exact PBQ weighting is guessing. What the published facts do tell you is the scale you are working against: 85 questions in 165 minutes, with the Security operations domain carrying 34% of the marks.

Six common mistakes

These are the six ways learners lose PBQ points that have nothing to do with knowledge. Each one is fixable in a single practice sitting.

• Starting to type before reading the deliverable. The task line, not the story, says what is graded: "allow 443 to the web tier", "mark the compromised hosts", "order the containment". On CS0-004 a log triage task can look familiar and still ask for the opposite of last time. Read the deliverable twice and say it back to yourself before you touch the workspace.
• Treating a PBQ like a multiple-choice question. There is no partial guess to make. On CS0-004 the log triage and terminal and sorting formats are scored item by item, so a blank item and a wrong item cost the same, and a nearly-right answer earns more than an empty one. Fill every item, in your best order, then go back to the ones you flagged.
• Losing the whole task to one stuck item. A single stubborn row can eat the twelve minutes the rest of the scenario needed. Set a hard limit of about ninety seconds on any one item, write your best answer, flag it and move on. The Security operations domain is 34% of CS0-004; no single PBQ item is worth failing the rest of the section for.
• Ignoring the order inside an ordered task. Firewall rules are first-match-wins and incident response has a sequence that survives an audit. If the task says order, a correct set in the wrong order is still wrong, and the terminal format scores position by position. Ask which step has to happen before another, then build from the constraint end.
• Never checking your own work. Every workspace can be inspected before you submit: the packet verdicts, the file permissions, the service state, the show output. Re-read the deliverable and prove each line of it in the tool. Learners lose more points to an unchecked second row than to a missing idea.
• Skipping the debrief after a miss. The score report names the item, the value you gave and the value required. That report is the study material. Copy the two or three misses into notes and open the objective page for them the same day, or the same mistake returns in the next CS0-004 sitting under a different story.

Where the PBQs sit in the CS0-004 sitting

CompTIA puts the performance-based questions in a block at the start of the sitting. That is deliberate: it is the part where a rushed start costs the most, and the clock is already running. Budget your first pass for the PBQs, finish the ones you can complete cleanly, flag the rest, and move to the multiple-choice section with time left to come back.

Practise the whole shape, not just the workspace: a timer, a mixed set, and a decision about what to flag. The app's timed simulations run the 85-question, 165-minute shape, and the free tier gives you three PBQs and thirty questions a day before you decide anything about paying.

A practice plan that fits a week

Day one: open the free scenario on this page and submit it without hints, even if you are unsure. Read the score report line by line. Day two: take the CS0-004 practice test on this site and note which domain the misses come from. Day three and four: work the matching labs, which use the same surfaces as the PBQs but grade a job rather than a deliverable. Day five: come back to the scenario and score it again with the hints off; if the second attempt is not clean, the gap is in the Security operations domain, not in the workspace.

Keep a short note per miss: the item, the value you gave, the value required, and the objective id. That note is worth more than a second video course, because it is the only record of what you personally get wrong.

What the workspace looks like

Real captures from the PBQ workspaces in the app, annotated to point at the parts that decide the score. Each caption names the exam and the scenario it shows.

CS0-004 PBQ questions