I took (and passed) the CAS-003 exam last week. I thought the PBQs were very fair. The emphasis on my exam was on situational (scenario) type questions. I think the key to those questions is reading and answering the question without reading into the question. There were more coding (or identifying hostile / bad code) questions than I expected. This was a topic that I expected that I've found is not well covered in any of the commercially available texts. Many of my students come from a network background so I'll need to prepare better materials with more coding examples.