Free Cybersecurity Analyst Practice Assessment (2026)

Cohesyve · Practice for candidates

Going for a Cybersecurity Analyst role? Find out how you'd actually score.

Run a Cybersecurity Analyst simulation built the same way employers build theirs, and get a full report showing exactly where you lost marks — before it counts.

free assessments a month

no card required

Full

scored report every run

Every

question type included

5 free assessments a month · No card required · Pro from $16/mo

Overview

Security analyst assessments are built around evidence. You are given logs, an alert queue, a phishing report or a scan output, and asked what happened, what you would do next, and how you would prove it. Tool familiarity matters less than investigative discipline and the ability to write up a finding someone else can act on. This page covers the usual formats and what assessors are looking for.

Why employers assess this role

The cost of a weak analyst is measured in dwell time — an alert dismissed as noise, or an escalation with no evidence attached, changes the outcome of an incident. Employers assess practically because everyone lists the same frameworks and tools on a CV, while the ability to reason from a log line to a conclusion shows up within minutes of a real exercise.

What gets tested

Log analysis and event correlationAlert triage and false positive judgementIncident response process and escalationThreat identification and attacker technique mappingVulnerability assessment and risk prioritisationPhishing and email header analysisClear written incident documentationKnowing when and how to escalate

The format

Duration

45–90 minutes

Question types

Log analysis and investigation scenario
Alert triage queue with prioritisation
Incident write-up and escalation decision
Vulnerability report prioritisation exercise

Levels

Entry · Mid · Senior

What you'll be asked to do

Investigate from logs

You are given raw events — authentication logs, firewall records, endpoint telemetry — and asked to reconstruct what happened. Scored on the chain of reasoning as much as on the conclusion.

•Determine whether a series of failed then successful logins represents a compromise
•Trace lateral movement across three hosts from authentication and process events
•Identify data exfiltration in outbound traffic logs and estimate what left

Triage an alert queue

A realistic queue with more alerts than time. Assessors watch whether prioritisation is driven by risk or by whatever appears at the top of the list.

•Rank eight alerts for investigation order and justify the top three
•Decide which alerts are false positives and state what evidence settles it
•Identify which two alerts in the queue are related to the same activity

Analyse a phishing report

A forwarded email with headers and attachments or links. This appears in nearly every analyst assessment because it is a daily task in the role.

•Analyse the headers and state whether the sender domain is spoofed
•Assess an attached document safely and describe what you would check
•Decide what containment action to take if a user has already clicked

Prioritise vulnerabilities

Given scan output far larger than any remediation capacity, decide what gets fixed first and defend it. Severity scores alone are not accepted as the answer.

•Rank findings across internet-facing and internal systems with limited patching capacity
•Explain why a medium-severity finding on an exposed host outranks a critical on an isolated one
•Propose a compensating control where patching is not possible this quarter

Cohesyve for candidates

Practise a Cybersecurity Analyst assessment before the real one

Run the same AI job simulations companies use to evaluate applicants. You get a scored report showing where you're strong and where you're not, plus what to work on.

Sample tasks — and what strong looks like

You are given authentication logs showing forty failed logins for one account from a single address, followed by a success, followed by access to a file share. Explain what happened and what you would do.

Entry

What strong looks like: Names it as a probable successful brute force or credential stuffing, checks whether the source address and user agent match the account's normal behaviour, establishes what was accessed after the success, and moves to containment — disabling the session and the credential — before completing analysis. Weak answers describe the pattern accurately but stop short of any action or any check on what the attacker did next.

A user reports an email that appears to come from the finance director asking for an urgent payment change. Analyse it and recommend a response.

Mid

What strong looks like: Reads the full headers rather than the display name, checks the sending domain against authentication records, notes reply-to mismatch and lookalike domains, then searches the mail environment for other recipients of the same campaign. Weak answers judge the message on the wording alone and never establish blast radius.

Write the incident report for a confirmed malware infection on a single workstation, addressed to a manager who is not technical.

Mid

What strong looks like: Opens with impact and current status, gives a clear timeline with timestamps, separates confirmed facts from assessment, states containment actions taken and outstanding risks, and closes with specific recommendations. Weak reports are a chronological dump of tool output with no statement of what it means for the business.

An alert fires for an unusual outbound connection from a production server. Decide whether to isolate the host immediately, and defend the decision.

Senior

What strong looks like: Weighs the evidence strength against the operational cost of isolation, states what quick checks would raise or lower confidence, names who must be informed before a production system is taken offline, and commits to a decision rather than deferring indefinitely. Weak answers either isolate reflexively or escalate without doing any triage first.

How to prepare

#1
Practise reading raw logs without a search interface in front of you, because assessments frequently hand you a flat file and the ability to spot the anomaly manually is exactly what is being measured.
#2
Rehearse the phishing header walk-through until it is routine — sender authentication, reply-to, return path, received chain, link destination — since it appears in almost every analyst assessment.
#3
Write practice incident reports for scenarios you invent, then reread them and ask whether a manager could make a decision from the first paragraph alone.
#4
Learn to state confidence explicitly, distinguishing what the evidence proves from what you assess as likely, because conflating the two is heavily penalised.
#5
Work through prioritisation exercises where the number of alerts exceeds the time available, so triage under pressure becomes a habit rather than an improvisation.
#6
Sit a full timed simulation end to end, since analysts commonly investigate well and then run out of time before writing anything up.

Common mistakes

Reaching a conclusion without stating the evidence that supports it.
Dismissing an alert as a false positive without documenting what made it one.
Investigating thoroughly but never taking or recommending a containment action.
Writing up findings in tool output rather than in language a decision-maker can use.
Ranking vulnerabilities purely by severity score with no regard to exposure or exploitability.
Escalating everything, which in a real queue is functionally the same as escalating nothing.

How it's scored

Criterion	What strong looks like
Investigative reasoning	The conclusion is built from specific evidence in the data provided, with each step of the chain visible and alternative explanations considered and ruled out.
Triage and prioritisation	Ordering is driven by exposure, asset value and exploitability, and the reasoning is stated rather than implied by the ranking alone.
Response actions	Containment is proportionate to the evidence and the business impact, and the candidate names who needs to be told and when.
Documentation quality	Impact first, an accurate timeline, facts separated from assessment, and clear next steps that another analyst could pick up cold.
Judgement under uncertainty	Confidence levels are stated explicitly and a decision is made on incomplete information rather than deferred until certainty arrives.

Frequently Asked Questions

Which security tools will I be tested on?

Most assessments provide the data rather than the platform — log extracts, alert summaries, scan output — precisely so that tool familiarity does not decide the outcome. Where a specific platform is used it is normally named in advance.

Do I need a certification to pass?

No. Certifications help with vocabulary and framework knowledge, but these assessments score investigation and write-up, and candidates without certifications regularly outscore those with them on both.

What if I cannot determine what happened from the data?

Say so, state what you did establish, and name exactly what additional evidence would settle the question. Admitting uncertainty with a clear next step scores considerably better than committing confidently to an unsupported conclusion.

How much weight does the written report carry?

More than most candidates expect. Documentation is a large part of the job, and an investigation that reaches the right answer but is written up unclearly typically loses a meaningful share of the available marks.

Is there a way to practise before the real assessment?

Yes — practise on a scored scenario rather than reading write-ups. Cohesyve gives you five free assessments a month with a full report, so you can find out whether your reasoning and your write-up hold up under marking.

Practise another role

Cohesyve · Practice for candidates

Practise a Cybersecurity Analyst assessment now — free.

Five scored assessments a month, a full report on every run, and a learning pathway built from what you got wrong. No card required.