6.1. Exam Strategy and Time Management

The CySA+ exam gives you 165 minutes for up to 85 questions — roughly 2 minutes per question. Performance-based questions (PBQs) typically appear at the start and take longer; budget 5–8 minutes each. Flag them and return if you're spending too much time.

Time allocation strategy:

1. Answer all standard multiple-choice questions you're confident about first (1–1.5 min each)
2. Flag and skip PBQs that are taking more than 4 minutes on first pass
3. Flag and skip any question where you're torn between two answers — move on; your first instinct is usually better
4. Return to flagged questions with remaining time
5. Never leave a question blank — there's no penalty for guessing

Question reading strategy for "Given a scenario" questions:

1. Read the last sentence first — it tells you what's actually being asked
2. Identify the scenario type: detection, investigation, prioritization, response action, or communication
3. Eliminate obviously wrong answers (often two are clearly off; the choice is between two plausibles)
4. For prioritization questions: think impact × likelihood × exploitability
5. For "next step" questions: follow the IR sequence (scope before contain; contain before eradicate; preserve evidence before changing system state)

Common exam traps to watch for:

• "Best" vs. "first" — "What should you do first?" vs. "What is the best action?" require different reasoning
• CVSS score ≠ remediation priority without context
• Containment ≠ eradication ≠ resolution — know which phase each action belongs to
• SIEM alerts; SOAR responds — don't swap their roles
• SPF/DKIM/DMARC pass ≠ legitimate email — attackers register domains that pass all three