Security+ Exam Day Strategy and Performance-Based Questions

You can know the material and still fail SY0-701 by mismanaging time, freezing on a firewall configuration PBQ, or letting one difficult question bleed into the next three. The exam is 90 questions in 90 minutes with a passing score of 750 on a scale of 100–900. That math gives you roughly one minute per question on average—but the average is fiction. PBQs break it, some multiple-choice items resolve in thirty seconds, and a few scenario questions will take two minutes of careful parsing. What you need is not an average. You need a pacing structure that treats the exam as four phases and a mental habit that extracts the right answer from the stem rather than choosing the most reassuring option from the choices.

Before You Sit Down

The administrative decisions should be settled before exam week, not during it. Confirm whether you are testing at a Pearson VUE center or through OnVUE online proctoring, and know the ID requirements for whichever mode you chose. At an in-person center, CompTIA typically provides a wipeable note board and marker—your own paper is not permitted. For OnVUE, the room setup matters in ways that will trigger a failed check-in if you miss them: clear desk, no headphones unless explicitly approved by the proctor, phone out of reach and ideally in another room.

The night before, sleep wins over a 3 a.m. acronym cram. If you review anything, make it brief: one pass through the IR lifecycle order spoken aloud, one ALE calculation worked by hand, and a look at your personal confusion pairs list—IDS/IPS, CRL/OCSP, SLE/ALE, RTO/RPO, DAC/MAC, TPM/HSM. Running a full practice exam the night before erodes more through fatigue than it builds through last-minute exposure.

One thing worth knowing before you sit: Pearson and OnVUE technical failures happen, and most candidates are caught off guard when they do. If your browser crashes mid-exam during an OnVUE session, do not close the application window. Reconnect first inside the same window—the session can usually be resumed without restarting. If reconnection fails, contact Pearson VUE support immediately and note the time of the failure. For in-person testing, a workstation failure is resolved by the proctor; your answers to completed questions are preserved when the session is transferred to a new machine. Knowing this path in advance turns a thirty-second disruption into a thirty-second disruption, not a ten-minute spiral that cost you the pacing window.

The 90-Minute Pacing Plan

Think in four phases, not ninety individual minutes.

During Phase 1, the operating rule is: read the stem once, predict the answer before looking at the options, select your prediction if it appears and nothing in the stem contradicts it, and move on. The moment a question starts consuming more than sixty seconds of circular thinking, flag it and skip. You are not conceding the question—you are preserving the minutes that a PBQ will need. When you encounter a PBQ early in the exam, spend thirty seconds deciding whether it is a quick drag-and-drop or a complex simulator. If it is complex, flag it and return in Phase 2. Banking straightforward multiple-choice answers first builds a score floor while your sharpest attention is still available for harder configurations. A single PBQ is typically worth more than one multiple-choice item, but not more than five—if you are ten minutes into a PBQ with no meaningful progress, make your best attempt, flag it, and move on.

In Phase 2, return to PBQs in estimated order of difficulty: simple matching or ordering tasks first, complex firewall editors last. Read all instructions before clicking anything—some PBQs reward a specific ordering, and an early mis-click can cascade. Apply domain instincts without hesitation: firewalls want implicit deny and least privilege; the IR lifecycle opens with Preparation and closes with Lessons Learned; network diagrams put IDS on span ports and IPS inline. Before leaving each PBQ, do one review pass. Do not submit an empty configuration.

Phase 3 is a second look at flagged multiple-choice questions with eyes that have had some distance. The most common reason for changing an answer is discovering a constraint you skipped on first read—something like "cannot modify the legacy system" or "the organization requires real-time status" that shifts the answer entirely. Read the stem again, identify the constraint words, and change your answer only when the second read reveals something the first missed. Phase 4 confirms that no question is blank—CompTIA does not penalize guessing, and an unanswered question is a guaranteed zero.

How to Read a Stem Without Looking at the Options First

The single most effective habit you can build before exam day is predicting the answer before your eyes reach the answer choices. Distractors are written by people who know exactly which wrong answer feels right under pressure. If you arrive at the options with a prediction already formed in plain English, you are choosing between your reasoning and four candidates—not being pulled toward the most authoritative-sounding distractor.

Every SY0-701 scenario contains four extractable elements. Take fifteen seconds and find them before reading answers.

The goal word is the question's surgical knife. Prevent points to controls that stop something before it happens. Detect points to monitoring and alerting. Respond points to incident handling. Comply points to policy and documentation. Prioritize points to risk math. Swapping one for another is exactly how two technically correct answer choices diverge: an IPS prevents; an IDS detects. If the stem asks for detection on a legacy system that cannot be taken offline, the inline IPS is the wrong answer—even though it is the superior control in a greenfield design. Match your answer to the goal word, not to the generally correct security practice.

PBQs: The Five Patterns and How to Approach Each

PBQs are not mystery boxes. CompTIA uses a repeating set of formats, and recognizing the format immediately tells you the right cognitive mode.

Drag-and-drop matching asks you to place terms—protocols, controls, attack types, ports—next to their descriptions. The most efficient approach is to anchor the five items you know with certainty before touching the ones you are unsure about. Anchoring gives you a smaller decision space and often makes the remaining placements obvious by elimination.

Ordering and sequencing tasks ask you to arrange IR phases, forensic evidence collection steps, or change management stages in the correct sequence. First and last positions are almost always clear—Preparation opens the IR lifecycle and Lessons Learned closes it—so anchor those and debate only the middle. The most common IR ordering mistake is placing Recovery before Eradication. You eradicate the threat and verify it is gone, then recover clean systems onto trusted media. Getting that backwards is both a common exam error and a genuine operational failure.

Firewall and ACL configuration is where most candidates lose points through either overcautious freezing or careless breadth. The mindset you want before touching the first field is implicit deny: start with a default-deny posture and add only the specific allows the stem requires. Here is what the difference between a weak and a strong configuration looks like on a realistic requirement—"a web server in a DMZ should accept HTTPS from the internet and SSH from the management VLAN only." A weak attempt opens the required ports but leaves a default-allow posture or adds an any-any rule "just in case." A strong answer is precise: allow inbound TCP 443 from any source to the web server; allow inbound TCP 22 from the management VLAN IP range to the web server; deny everything else implicitly. No temporary rules, no broad exception for convenience. The exam rewards the tighter ruleset because it demonstrates that you are thinking about what should be blocked, not merely what should be open.

Log and IoC analysis PBQs present a short log snippet and ask you to identify the attack type, compromised account, or specific indicator. Look for anomalies that only become visible across multiple lines: off-hours authentication on a service account, a service account suddenly performing interactive logins, privilege escalation followed within minutes by outbound traffic to an unfamiliar IP, or a pattern of sequential failed logins on the same account that ends with a success. Name the specific indicator the question is pointing at—the account name, the IP, the hash—not a generic label like "malware" or "suspicious activity."

Network topology placement is a direct test of whether you understand the operating mode of each control. IDS belongs on a span or mirror port—it sees traffic but does not sit in the packet path. IPS sits inline between two segments and actively drops packets before they reach their destination. A WAF goes in front of web servers and inspects HTTP payloads. A SIEM collector receives logs forwarded from other devices; it never sits inline. Firewalls live at segment boundaries. Getting these placements right is the whole question; the diagram is just the delivery vehicle.

Distractor Families and How to Beat Them

CompTIA constructs wrong answers from a small set of recurring patterns. Recognizing the pattern often eliminates two choices before you finish reading the stem.

After reading the stem, mark the constraint words—cannot, must, least, first, best, at rest, in transit, detect, prevent, real-time. Your answer must address those words explicitly. If it solves the right general problem but ignores a stated constraint, it is a distractor regardless of how technically correct it sounds.

The Unscored Items You Cannot Identify

CompTIA seeds SY0-701 with unscored beta items that are being evaluated for future exams. You will encounter them, and you cannot tell which questions they are. A question that feels unusually strange, out of scope, or poorly worded may well be a beta item—but you cannot know, and treating any question as unscored is the wrong strategy. Answer every question as well as you can, flag anything uncertain, and move on without letting the unusual question color your confidence for the next ten.

Domain Remediation Map

If practice exams reveal specific weak spots, targeted reading beats re-doing the same questions and hoping for better results.

Mindset for the Exam Room

Every question is independent. A question that feels impossible does not mean you are failing—it may be a beta item, an unusually constructed scenario, or a topic that sat at the edge of your preparation. Breathe, extract the four stem elements, apply the goal word, and eliminate. If the answer is still unclear after a genuine pass, make your best selection and move forward. Spiraling on a single multiple-choice item is three minutes donated to the question's author and taken from your PBQ budget.

Change answers only when your second read of the stem reveals a constraint you missed the first time. First instincts are correct more often than third attempts—the exception is genuine new information in the stem, not anxiety pressing you to keep moving. And in the final five minutes, confirm that no answer field is blank. CompTIA does not penalize guessing. An educated guess on a question you flagged has positive expected value; leaving it blank has exactly zero.

Exam Traps Summary

Closing Frame

The exam is ninety minutes of applied judgment, not ninety minutes of vocabulary recall. Every skill that makes you a careful analyst—reading deliberately, extracting constraints before reaching for a solution, matching the right tool to the right problem, not overreacting when information is incomplete—works in your favor across every question type. The pacing plan keeps panic from compounding. The stem-parsing habit keeps distractors from steering you. The PBQ patterns mean you walk into a firewall configuration task already knowing the mental posture you need.

Companion reading: the Acronyms That Matter post for last-minute discrimination practice on the pairs most commonly tested in PBQs, and the domain posts mapped in the remediation table above for any topic that still feels unsteady.