Cybersecurity Analyst exam: what is tested and how to prepare

Updated 16 September 2026 · 3 min read

Cybersecurity analyst tests look for people who can think like a defender under pressure. You may be shown a log extract and asked what happened, given a set of controls and asked which one stops a particular attack, or described an incident and asked what to do first. Memorised definitions help, but the marks go to candidates who can connect an attack to the evidence it leaves and the control that prevents it.

How this guide was made

Written for this site with AI assistance, then checked automatically before publishing. The topic table, sample questions, worked examples and study plan are generated from this site’s question bank: each worked example is recalculated by separate code, and each sample answer says where it came from.

The guide deliberately states no salaries, grades, pass marks or exam dates. Those change, and they could not be checked here, so take them from the advert itself.

This site is independent and is not affiliated with MIFOTRA or any employer.

Topics the questions draw on

Threats and attacks: phishing, malware and ransomware, password attacks, web attacks such as SQL injection, and denial of service.
Security controls: preventive, detective and corrective controls, and technical, managerial and physical ones.
Identity and access: authentication factors, multi-factor authentication, least privilege and access reviews.
Cryptography: hashing, symmetric and asymmetric encryption, certificates, and what each one protects.
Network security: firewalls, segmentation, VPNs, intrusion detection and the ports attackers target.
Monitoring: logs, SIEM alerts, endpoint detection, and telling false positives from real attacks.
Vulnerability management: scanning, CVE identifiers, severity scores and prioritising fixes.
Incident response: preparation, detection and analysis, containment, eradication, recovery and lessons learned.

Where to spend your study time

The suggested emphasis reflects what this position works with day to day. It is a study guide, not a published exam blueprint.

Area	Suggested emphasis	Questions in the bank	Practise
Cybersecurity	45%	541	Security
Networking fundamentals	18%	2,636	Networking
Ports and protocols	18%	264	Networking
Linux command line	9%	360	In the full bank
Cloud and emerging technology	9%	188	In the full bank

Reading evidence

Analyst questions often show evidence rather than describe it. A burst of failed logons against many accounts from one address, followed by a success, points to password spraying or brute force. On Windows, event ID 4625 records a failed logon and 4624 a successful one, so knowing those two IDs makes log questions much faster. Web server logs containing fragments such as ' OR 1=1 suggest SQL injection attempts. Practise reading short log extracts until you can say what happened in one sentence.

Matching attacks to controls

A common question type names an attack and asks which control mitigates it best. Multi-factor authentication blunts stolen passwords. Input validation and parameterised queries stop SQL injection. Awareness training and email filtering reduce phishing. Offline backups limit the damage of ransomware. Build a two-column table of attacks and their best controls, and quiz yourself until you can answer instantly.

Incident response order

Questions about incidents reward the correct order. Contain the threat before trying to remove it, and preserve evidence before wiping anything. An option that reimages an infected computer immediately may look decisive, but it destroys evidence and does nothing about how the attacker got in. Learn the phases well enough to spot an answer that jumps ahead.

Cloud and identity in modern attacks

Attacks increasingly target accounts rather than servers. A stolen password or session token can give an attacker access to email, files and applications without touching a single machine on the network. Expect questions on multi-factor authentication, conditional access, suspicious sign-in patterns and the logs that cloud platforms produce. Understanding identity as the new perimeter explains why so many controls now sit around accounts rather than around the office network.

How to prepare

Study the concepts, then practise with real material. Sample logs, capture-the-flag challenges and a home lab with a SIEM or intrusion detection system turn abstract ideas into skills. Work through questions daily, keep a log of mistakes by topic, and use the Security+ exam objectives as a checklist of what a well-rounded analyst should know.

Try a few now

A user reports that they are unable to access the hospital management system due to a denial-of-service (DoS) attack. What steps would you take to mitigate the attack and restore system availability?
1. Implement a web application firewall (WAF) to filter malicious traffic
2. All the answer are correct
3. Utilize a content delivery network (CDN) to distribute the system's resources
4. Implement rate-limiting mechanisms to prevent excessive requests
Show the answer
B. All the answer are correct
WAF filtering, rate limiting and CDN distribution are complementary layers of DoS mitigation, normally deployed together rather than chosen between.
Real past-paper question; answer cross-checked against the original session. Open this question
An employee unknowingly downloads a malicious browser extension that records every keystroke made on banking websites and sends the text to an external server. This malware is a...
1. Keylogger
2. Worm
3. Adware
4. Rootkit
Show the answer
A. Keylogger
A keylogger records user keystrokes, often to steal credentials, credit card numbers, or other sensitive information.
Original practice question, written against published exam objectives. Open this question
Which of the following is an example of a phishing attack?
1. An email that asks for personal information by pretending to be from a legitimate source
2. A system-generated error message
3. A newsletter subscription confirmation
4. A software update notification
Show the answer
A. An email that asks for personal information by pretending to be from a legitimate source
Phishing is social engineering by impersonation - a message that pretends to be a trusted sender in order to extract credentials or personal data.
Real past-paper question; answer cross-checked against the original session. Open this question
The hospital management system is experiencing issues with user authentication due to a compromised authentication token. What is the best approach to resolve this issue while minimizing disruption to patient care?
1. Utilize a multi-factor authentication system to add an additional layer of security
2. Implement a token revocation mechanism to invalidate compromised tokens
3. Implement a token-based authentication system with secure token storage
4. both b) and c)
Show the answer
D. both b) and c)
Combining multi-factor authentication with securely stored tokens both contains the current compromise and hardens against the next one.
Real past-paper question; answer cross-checked against the original session. Open this question

Common questions

Do I need to know how to hack to pass a cybersecurity analyst test?

You need to understand how attacks work and what evidence they leave, not to carry them out. Analyst tests focus on detection, analysis and defence.

Will there be questions on Rwandan law?

Some public-service tests include data protection and cybercrime principles. Understand the purpose of Rwanda's personal data protection law, Law N° 058/2021, and the role of the National Cyber Security Authority in general terms.

How important are port numbers?

Quite important. Many questions involve firewall rules or suspicious connections, so know the common ports well, especially those for remote access, file sharing, email and web traffic.