Security+ Exam Day Strategy and Performance-Based Questions

You can know the material and still fail SY0-701 by mismanaging time, freezing on Performance-Based Questions (PBQs), or overthinking straightforward stems. The exam is 90 questions in 90 minutes with a passing score of 750 on a scale of 100–900. That math gives you roughly one minute per question on average—but PBQs break the average, and some multiple-choice items take 30 seconds while others take two minutes.

This post treats exam day as an operational procedure: a pacing plan, PBQ patterns, an elimination framework, and a full sample stem walkthrough you can reuse on every question.

Before You Sit Down

What to Confirm the Week Before

• Testing format: In-person at a Pearson VUE center or online with OnVUE proctoring
• Identification requirements for your testing mode
• Room setup rules for online testing (clear desk, no headphones unless approved, phone out of reach)
• What CompTIA provides: Typically wipeable note board and marker—not your own paper

What to Do the Night Before

Sleep beats a 3 a.m. acronym cram. If you must review, limit it to:

• IR lifecycle order (one pass, aloud)
• One ALE calculation
• Your personal "confusion pairs" list (IDS/IPS, CRL/OCSP, SLE/ALE, RTO/RPO)

Do not run a full practice exam the night before. Fatigue on exam day costs more than one refresher would gain.

The 90-Minute Pacing Plan

Think in four phases, not 90 individual minutes.

Phase 1 Rules (Minutes 0–60)

1. Read the stem once. Tag mentally: asset, threat, constraint, goal.
2. Predict the answer before reading options.
3. If your prediction is among the choices and nothing contradicts the stem, select it and move on.
4. If stuck after 60 seconds, flag and skip. Do not negotiate with a question that is eating your PBQ budget.
5. When you encounter a PBQ early in the exam, look at it for 30 seconds. If it is a complex firewall or drag-and-drop network diagram, flag it immediately and return during Phase 2. Banking easy multiple-choice points first builds confidence and guarantees a score floor.

Critical rule: Do not let one PBQ consume 15 minutes of pride. A single PBQ is typically worth more than one multiple-choice question, but not more than five. If you are 10 minutes into a PBQ with no progress, make your best attempt, flag it, and move on.

Phase 2 Rules (Minutes 60–78)

1. Open flagged PBQs in order of estimated difficulty—quick ordering or matching tasks first, complex simulators last.
2. Read all instructions before clicking anything. Some PBQs require specific ordering; others have partial-credit design.
3. Apply domain instincts:

- Firewalls: implicit deny, least privilege, deny by default - IR ordering: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned - Network diagrams: place IDS on span/mirror ports (passive), IPS inline (active)

1. Before submitting each PBQ, review your work once. Do not submit empty configurations.

Phase 3 and 4 (Minutes 78–90)

Revisit flagged multiple-choice questions with fresh eyes. On second read:

• Did you miss a constraint ("cannot modify the legacy system")?
• Did you confuse two similar acronyms?
• Did you overthink a straightforward "best practice" question?

In the final five minutes, ensure every question has an answer. CompTIA does not penalize guessing. An unanswered question is a guaranteed zero.

How to Read a Security+ Stem

Most SY0-701 items are scenarios, not definition recalls. Before looking at answer choices, extract four elements:

The goal word matters enormously. Prevent, detect, respond, comply, prioritize—each points to a different control category.

Sample Stem Walkthrough: Elimination in Action

Here is a realistic SY0-701-style scenario with a full elimination walkthrough.

---

Stem: A healthcare organization stores patient records in a cloud-hosted database. Compliance requires that data at rest be protected, and the security team needs a solution that provides centralized key management with hardware-backed key storage meeting FIPS 140-2 Level 3. The application team cannot modify application code. Which of the following best meets these requirements?

A. Deploy a TPM chip in each application server B. Implement TLS 1.3 for database connections C. Deploy a HSM for encryption key management D. Enable BitLocker on the database server operating system

---

Step 1: Tag the stem

Step 2: Predict before reading options

You need centralized, hardware-backed key management for encryption at rest without touching application code. That points toward an HSM or cloud KMS backed by HSM.

Step 3: Evaluate each option

A. TPM — Endpoint-embedded, not centralized. Eliminate.

B. TLS 1.3 — Protects data in transit, not at rest. Eliminate.

C. HSM — Dedicated appliance for centralized, FIPS-validated key management. Database integrates without code changes. Keep.

D. BitLocker — Full-disk encryption at OS level, not centralized database key management. Eliminate.

Step 4: Select and move on

Answer: C. HSM

Time spent: approximately 75 seconds. Tag nothing; advance to the next question.

What this walkthrough teaches

• Constraint words ("at rest," "centralized," "cannot modify code") eliminate two options immediately
• TLS vs. encryption at rest is a recurring trap—always check which state of data the stem describes
• TPM vs. HSM discrimination: TPM is per-endpoint; HSM is enterprise centralized
• Predicting before reading options prevents distractor pull

PBQ Patterns and How to Approach Them

CompTIA PBQs on SY0-701 commonly fall into these categories:

1. Drag-and-Drop Matching

Pattern: Match controls, protocols, ports, or attack types to descriptions.

Approach:

• Scan all items and targets first
• Place the five you are certain about
• Use elimination on the remainder
• Do not leave items unplaced if the interface allows partial submission

Example: Match "CRL," "OCSP," "CSR," "CA" to their descriptions. If you know CA issues certs and OCSP is real-time revocation, two matches are free—narrow the rest.

2. Ordering / Sequencing

Pattern: Arrange IR steps, incident phases, or process stages in correct order.

Approach:

• Know these cold: IR lifecycle, change management steps, forensic evidence collection order
• First and last are often obvious (Preparation first; Lessons Learned last)
• Debate only the middle items

Exam trap: "Recovery before eradication" is a common mistake. You eradicate the threat, then recover clean systems.

3. Firewall / ACL Configuration

Pattern: Given a network diagram and requirements, configure allow/deny rules.

Approach:

• Start with implicit deny mindset
• Apply least privilege—allow only what the stem requires
• Read direction carefully (inbound vs. outbound)
• Do not add "temporary" any-any rules unless the stem explicitly asks for a break-glass scenario

Example requirements: "Web server in DMZ should accept HTTPS from internet and SSH from management VLAN only."

Allow: INBOUND TCP 443 from ANY → Web Server
Allow: INBOUND TCP 22 from Management VLAN → Web Server
Deny: ALL (implicit)

4. Log / IoC Analysis

Pattern: Review a snippet of logs and identify the attack type, compromised account, or indicator.

Approach:

• Look for anomalies: off-hours logins, privilege escalation, unusual outbound connections, brute-force patterns
• Map findings to ATT&CK tactics if possible (initial access, lateral movement, exfiltration)
• Name the specific indicator (account, IP, hash)—not just "malware"

5. Network Topology Placement

Pattern: Place devices (IDS, IPS, firewall, WAF, SIEM collector) on a diagram.

Approach:

• IDS: span port / tap (passive, out-of-band)
• IPS: inline between segments (active, can block)
• WAF: in front of web servers (HTTP/HTTPS inspection)
• Firewall: at segment boundaries
• SIEM collector: does not sit inline—it receives logs

6. Cryptography / PKI Actions

Pattern: Choose the correct certificate action, key type, or encryption method for a described need.

Approach:

• Symmetric (AES) for bulk data; asymmetric (RSA/ECC) for key exchange and signatures
• Certificate expired → renew/replace, not revoke (revoke is for compromise)
• Certificate compromised → revoke + CRL/OCSP update

Distractor Families and How to Beat Them

CompTIA constructs wrong answers systematically. Recognizing the pattern speeds elimination.

Technique: After reading the stem, underline (mentally or on the note board) constraint words: cannot, must, least, first, best, at rest, in transit, detect, prevent. Match your answer to those words explicitly.

Mindset and Anxiety Management

• Each question is independent. A hard question does not mean you are failing. CompTIA includes unscored beta items you cannot distinguish from scored ones.
• If anxiety spikes, treat the next question as a fresh ticket. Breathe once, tag the stem's four elements, and proceed.
• Do not change answers without new evidence. Your first instinct is correct more often than your third guess—unless your second read revealed a constraint you missed.
• Flag, do not spiral. Spending three minutes debating one multiple-choice item is three minutes stolen from a PBQ.

Final Week Checklist

• [ ] Two timed practice exams (90 questions, 90 minutes) with full review of every miss
• [ ] Domain 4 (Security Operations) and Domain 2 (Threats) weak spots rebuilt with scenario practice
• [ ] IR lifecycle recited aloud from memory
• [ ] ALE/SLE/ARO calculated by hand at least three times with different given variables
• [ ] One PBQ-style drill daily (firewall rules, IR ordering, or device placement—even on paper)
• [ ] Confusion pairs list reviewed: IDS/IPS, CRL/OCSP, SLE/ALE, RTO/RPO, DAC/MAC/RBAC, TPM/HSM
• [ ] Testing logistics confirmed (location, ID, proctor rules, arrival time)

Treat the exam like an incident: prepare your playbooks, execute calmly, contain panic when a question stalls, recover your flagged items in the review phase, and document lessons learned if you retake.

Good luck.