Questions? Call 1.800.716.8955

PASS the CompTIA Security+ (SY0-801)

Test-Taking Strategy

Knowing the material is necessary but not sufficient. Security+ questions are written in a particular style, and learning to read them accurately is worth a meaningful number of points.

Read the Question Stem Carefully

Before you look at the answer options, identify three things in the question stem:

  • The situation. What is happening? Who is involved? What has already been done?
  • The constraint. Is there a budget limit, a requirement to minimize downtime, a regulatory requirement, or a need to preserve evidence?
  • The qualifier. Is the question asking for the BEST answer, the FIRST step, the MOST likely cause, or the LEAST expensive option?

Qualifiers matter enormously. When a question asks for the FIRST thing you should do, several options may all be correct actions, but only one comes first in the proper sequence. When a question asks for the BEST solution, more than one option may work, but one meets the stated requirements more completely or more efficiently.

Exam tip

Watch for words like BEST, MOST, FIRST, NEXT, PRIMARY, LEAST, and MOST LIKELY. CompTIA often capitalizes them. Underline them mentally and reread the stem once you have chosen an answer to confirm your choice actually answers the question asked.

Eliminate Wrong Answers

Most questions have four options. Often you can quickly eliminate one or two that are clearly wrong because they belong to a different category (for example, a physical control offered as the answer to a question about application vulnerabilities) or because they do not address the problem described. Choosing between two plausible answers is much easier than choosing among four.

Think Like CompTIA

The "CompTIA answer" is the one that reflects recognized best practices and the terminology in the exam objectives. A few general principles help:

  • Policy and process come first. If a question asks what an organization should do first to address a recurring problem, establishing a policy or process is often the right answer before buying technology.
  • Least privilege and defense in depth are always good. When in doubt between giving more access and giving less, choose less.
  • Preserve evidence. In incident response and forensics questions, actions that destroy volatile evidence (such as powering off a system before capturing memory) are usually wrong unless containment requires them.
  • Follow the defined sequence. Incident response, change management, and risk management all have defined processes. Questions about what to do next expect you to follow the sequence.
  • Use the most specific term. If an attack is clearly whaling (phishing aimed at an executive), "whaling" is a better answer than "phishing," even though whaling is a form of phishing.

Manage Your Time

You have 90 minutes for up to 90 questions. A sensible approach is:

  • 1. Skim the first few questions. If they are PBQs, flag them and move on.
  • 2. Answer all multiple-choice questions at a steady pace of about 45 to 60 seconds each. Flag any you are unsure of.
  • 3. Return to the PBQs. You should have 25 to 35 minutes available for them.
  • 4. Use any remaining time to review flagged multiple-choice questions.

Do not change answers without a clear reason. Your first instinct is often correct; change an answer only if you realize you misread the question or remember a specific fact that proves your first choice wrong.

Handling Performance-Based Questions

  • Read all the instructions in the PBQ, including any scroll-down text and pop-up details on devices in a diagram.
  • Look for a reset button and know that partial credit may be available on PBQs, so complete as much as you can.
  • Do not overthink. PBQs test the same concepts as multiple-choice questions; they just present them interactively.
  • Check every tab or panel. Some PBQs have multiple screens, and it is easy to miss one.

Exam Day Checklist

  • Bring two forms of valid identification for a test center, or have your ID ready for online check-in.
  • Arrive 15 to 30 minutes early (or begin online check-in early).
  • Read the nondisclosure agreement and tutorial screens; they do not count against your exam time.
  • Use the provided whiteboard or scratch paper to jot down port numbers, formulas, and mnemonics you want to remember as soon as the exam begins.
  • Breathe. Ninety minutes is enough time if you manage it.
Use ← → to move between sections