CompTIA Security+ — All Questions
The figures these questions turn on, laid out by section on dense colour pages you can print: CompTIA Security+ cheat sheet PDF — $9.99 →
104 questions
Companies in the same industry exchange threat data through a trusted community so a breach at one helps the others defend proactively. Such an industry group is called a(n):
- a.Information sharing and analysis center (ISAC)✓
- b.A certificate authority
- c.A cloud access security broker
- d.A managed security service provider that operates and monitors security tools for clients
An Information Sharing and Analysis Center (ISAC) lets organizations in a sector share threat intelligence so each benefits from others' experiences. Collective defense turns one victim's detection into everyone's protection. Trusted industry threat sharing is the ISAC's purpose.
During an investigation, analysts realize a critical server was never forwarding its logs, leaving a gap in the timeline. The lesson for operations is to ensure:
- a.That every server in the environment is rebuilt from scratch after each investigation
- b.Comprehensive log source coverage✓
- c.That logs are deleted quickly
- d.That only the perimeter firewall forwards logs
Comprehensive log source coverage ensures every relevant system feeds the central platform, so investigations have no blind spots. A single non-reporting server can hide critical steps of an attack. Verifying that all important sources actually log is the lesson.
Analysts are overwhelmed manually copying data between the SIEM, ticketing system, and threat intel portal for every alert. Which improvement most directly addresses this repetitive toil?
- a.Hiring twice as many analysts to perform exactly the same manual copying
- b.Extending the analysts' workday
- c.Turning off the SIEM alerts entirely
- d.Integrating the tools with automated playbooks✓
Integrating tools with automated playbooks eliminates repetitive manual data movement, freeing analysts for judgment-intensive work. Adding staff or hours scales the toil rather than removing it. Automating the hand-offs between tools is the direct fix.
After each incident and quarterly review, a SOC updates its playbooks, tuning, and training based on measured outcomes and lessons learned. This ongoing refinement reflects a principle of:
- a.A one-time hardening effort completed only when the systems are first deployed
- b.Continuous improvement✓
- c.Implicit trust
- d.Obscurity alone
Continuous improvement uses feedback from incidents and reviews to steadily refine detection, response, and training over time. Security operations mature by learning and adjusting, not by standing still. Iterating on measured outcomes is the principle at work.
How hard is the exam?
CompTIA Security+ (currently exam SY0-701) is up to 90 questions — multiple-choice plus performance-based — in 90 minutes, with a passing score of 750 on a 100-900 scale, a higher bar than A+. The voucher is about $404. Information security analysts earn a median of about $124,910/year (BLS, May 2024) — one of the best-paid entry-level certifications.
- Recommended study hours
- 100-160 hours for most; more if networking fundamentals are new to you.
- Pass rate
- We read CompTIA's own published material in September 2026 and there is no pass rate in it. By stated policy: “it is CompTIA’s policy to not disclose pass rates to any external third party.” The Security+ page publishes the cut score, 750 on a 100-900 scale, and nothing about how many reach it.Source: CompTIA — Exam Development (test policies), on disclosure of pass rates
- Where to focus first
- Security Operations (28%) is the largest domain, followed by Threats, Vulnerabilities & Mitigations (22%) — together half the exam.
Fees and salaries are approximate and change over time. The pass rate above is quoted from the source linked beside it, for the period that source covers — where we have not checked a source, we say so and give no number.