Security+ Scenario Questions: How to Read and Answer Them (2026)
Most of the Security+ is a reading test. Here is how to find the constraint, the qualifier and the noise in a stem, with three examples taken apart option by option.
- Max 90Questions
- 90 minTime
- 750 (100-900)Pass mark
- ~1 minPer question
- BEST describesKey qualifier
Table of Contents
Security+ rarely asks you to recite a definition. It describes something a defender would see, such as a burst of failed logins, files that suddenly changed extension, or a caller asking for an MFA code, and asks which attack, control or response step BEST fits. Knowing the terms is not enough. Points are lost by matching the right family and picking the wrong member, or by choosing a control that detects when the stem asked for one that prevents.
SY0-701 gives you a maximum of 90 questions in 90 minutes, a mix of multiple-choice and performance-based questions, scored on a 100-900 scale with 750 to pass. That is about a minute per item before the PBQs take their share, so there is no time to reread a stem three times. This page gives you a fixed reading routine, a lexicon that maps symptom phrases to concepts, and three worked scenarios that show where the traps sit.
The one rule for reading Security+ stems
Treat every stem as evidence: translate each symptom into a concept, then let the qualifier choose between the near-misses.
Security+ options are almost always real terms from the objectives, and two of them often come from the same family. The stem contains the one detail that separates them, such as how many accounts were hit, whether the goal is to stop or to spot, or what must keep running. Find that detail before you read the options.
Read it like this
- Read the question line first to learn what you are naming
- Translate each observed symptom into an attack or control
- Name the stem phrase that kills each wrong option
Not like this
- Stop at the first option from the right category
- Pick an alert-only control when the stem says prevent
- Choose the fix that removes all risk but breaks a constraint
The 5-step decode routine
Run the same five steps on every scenario. The time on each step is a target for a practised reader, not a rule; the order is the part that matters.
- ~5s
Read the ask first
Jump to the last sentence. Are you naming an attack, a cause, a control or a step? Note the qualifier: BEST describes, MOST likely, FIRST, or Select TWO.
- ~15s
Translate the symptoms
Underline what the defender actually observed, such as failed logins, renamed files or a caller asking for codes, and map each to a concept with the lexicon. Two symptoms that agree usually settle the family.
- ~15s
Mark constraints, strike noise
Constraints are phrases like prevent, must remain in service, without blocking, or reduce likelihood. Noise is detail that would be true whichever option is right: staffing, a recent audit, the hosting provider.
- ~15s
Eliminate by constraint
Cross out every option a constraint kills and name the phrase that kills it. Detective controls die on 'prevent'; replace-everything dies on 'must remain in service'.
- ~10s
Rank with the qualifier
Between survivors, BEST describes wants the most specific name, MOST likely wants what the evidence supports, and FIRST follows the incident response order. Answer and move on; flag it only if two options still survive.
Anatomy of a Security+ scenario
Every highlighted phrase below is pinned to a note. Four kinds of phrase matter:
- Constrainta hard requirement that eliminates options
- Qualifierthe word that ranks the survivors
- Keywordpoints at a specific service, control or concept
- Noiselooks important, changes nothing
Failed logins across hundreds of accounts
A security analyst reviews overnight logs from the company's VPN portal. Between 01:00 and 03:00, about 400 different user accounts1 each recorded one or two failed logins2. Every attempt used one of the same three common passwords3, and no account reached the lockout threshold4. Two accounts later show a successful login. The source addresses belong to a large cloud hosting provider5. Which of the following BEST describes6 this activity?
Which of the following BEST describes this activity?
- 1Keyword. Breadth across hundreds of accounts is half of the signature. Brute force concentrates its guesses on one account at a time.
- 2Keyword. Very few attempts per account is the other half. It keeps each account under the lockout limit and rules out classic brute force.
- 3Constraint. A short, fixed list of common passwords reused across every account separates this from credential stuffing, which tries each account's own leaked password.
- 4Constraint. Confirms the attempts were paced to stay under lockout, which is the whole point of the technique. Answers built on rapid repeated guessing are out.
- 5Noise. Attackers rent cloud capacity for every attack in the option list, so the source network does not help you choose between them.
- 6Qualifier. Asks for the most specific correct name. Brute force is the right family, but there is a more precise label for this exact pattern.
- ABrute-force attackOutRight family, wrong member. Brute force throws many guesses at one account and would trip the lockout threshold the stem says was never reached.
- BPassword sprayingAnswerMany accounts, one or two attempts each, a short list of common passwords, and nothing locked out: the textbook spraying pattern. The defensive pairing is MFA plus alerting on failures spread across many accounts.
- CCredential stuffingOutStuffing replays username and password pairs leaked from another breach, so each account gets its own specific password. Here the same three passwords were tried everywhere.
- DCredential replayOutReplay reuses a captured valid credential or session, so you would expect successful logins on the first try, not a wave of failures with guessed passwords.
The lesson: For any password-attack stem ask two questions, how many accounts and how many tries per account, because many-and-few is spraying while one-and-many is brute force.
Two more: decode them yourself
Read each one as you would on the day: mark the constraints, find the qualifier, cross out what fails, and commit to a letter before you open the decode.
Stop the upload, don't just see it
A manufacturer applies a Confidential sensitivity label to its product design files. Last quarter, the SIEM alerted the SOC each time an employee uploaded a labeled file to a personal cloud storage account, but every file had already left the network before an analyst responded. The SOC has since hired two more analysts. The CISO wants a control that will stop these uploads before the data leaves, while still allowing uploads to the company's approved cloud file-sharing service. Which of the following would BEST meet this requirement?
Which of the following would BEST meet this requirement?
- ATune a SIEM correlation rule to page the on-call analyst within one minute of a labeled-file upload
- BConfigure a DLP policy that blocks files carrying the Confidential label from being uploaded anywhere except the approved file-sharing service
- CPublish an updated acceptable use policy and require every employee to acknowledge it
- DUse DNS filtering to block every cloud storage domain on the corporate network
Decode it and show the answer
A manufacturer applies a Confidential sensitivity label1 to its product design files. Last quarter, the SIEM alerted the SOC each time an employee uploaded a labeled file to a personal cloud storage account2, but every file had already left the network before an analyst responded. The SOC has since hired two more analysts.3 The CISO wants a control that will stop these uploads before the data leaves4, while still allowing uploads to the company's approved cloud file-sharing service5. Which of the following would BEST6 meet this requirement?
- 1Keyword. A classification label is something a data-aware control can match on directly, which points away from network-level blocking.
- 2Keyword. Identifies the exfiltration channel as an unsanctioned web upload. The control has to act on outbound data, not on inbound threats.
- 3Noise. More analysts speed up response, but response still starts after the upload. Staffing changes nothing about a requirement to block.
- 4Constraint. The core constraint. It eliminates every option that only alerts, logs or reports, however quickly it does so.
- 5Constraint. The second constraint. It eliminates any blunt block on all cloud storage, because the approved cloud service must keep working.
- 6Qualifier. Several options improve security. BEST means the one that satisfies both constraints with the most direct technical control.
- ATune a SIEM correlation rule to page the on-call analyst within one minute of a labeled-file uploadOutStill a detective control. A one-minute page arrives after the file has left, which fails the 'stop before the data leaves' constraint.
- BConfigure a DLP policy that blocks files carrying the Confidential label from being uploaded anywhere except the approved file-sharing serviceAnswerPreventive and data-aware. DLP matches the label and blocks the transfer as it happens, while the exception keeps the approved service working. Both constraints are met.
- CPublish an updated acceptable use policy and require every employee to acknowledge itOutA directive control. It sets the rule and supports accountability, but it cannot technically stop a single upload, so the prevent constraint kills it.
- DUse DNS filtering to block every cloud storage domain on the corporate networkOutPreventive but blunt. Blocking all cloud storage also blocks the approved service, which breaks the second constraint, and it ignores the label entirely.
The lesson: When the stem says stop, block or prevent, cross out every option that only alerts or logs, however fast, then check what else must keep working.
The system you can't patch or retire
A regional clinic's imaging software only runs on a legacy operating system that no longer receives security patches. The workstation must remain in service for 18 months until a replacement is funded. The clinic passed its annual external audit last month. The risk register rates the exposure as high, and the risk owner wants actions that reduce the likelihood of compromise during that period. Which of the following would BEST meet this goal? (Select TWO.)
Which of the following would BEST meet this goal? (Select TWO.)
- AMove the workstation to an isolated network segment with ACLs that permit only the traffic the imaging software needs
- BPurchase a cyber insurance policy that covers ransomware losses
- CDecommission the workstation now and purchase a replacement imaging system
- DEnforce an application allow list so that only the imaging software and required system processes can execute
- EHave the risk owner sign a formal risk acceptance and record it in the risk register
Decode it and show the answer
A regional clinic's imaging software only runs on a legacy operating system1 that no longer receives security patches2. The workstation must remain in service for 18 months3 until a replacement is funded. The clinic passed its annual external audit last month.4 The risk register rates the exposure as high, and the risk owner wants actions that reduce the likelihood of compromise5 during that period. Which of the following would BEST6 meet this goal? (Select TWO.)7
- 1Keyword. An unsupported system is the classic case for compensating controls: you protect around a system you cannot fix.
- 2Constraint. Patching, the normal mitigation, is off the table. Look for controls that limit exposure or execution rather than fixing the flaw itself.
- 3Constraint. Kills any answer that removes or replaces the system now, however secure that would be. The business has already set the timeline.
- 4Noise. A passed audit says nothing about this risk or which control reduces it. It is there to make doing nothing look reasonable.
- 5Constraint. The decisive verb. Likelihood is reduced by mitigation; transfer moves the financial impact and acceptance changes nothing about likelihood.
- 6Qualifier. Ranks the survivors: the most direct ways to cut likelihood while the system keeps running.
- 7Qualifier. Two answers, and each must meet the goal on its own. Do not pick a pair just because the two sound complementary.
- AMove the workstation to an isolated network segment with ACLs that permit only the traffic the imaging software needsAnswerSegmentation is a compensating control that shrinks who can reach the unpatched system. Fewer paths in means lower likelihood, and the system stays in service.
- BPurchase a cyber insurance policy that covers ransomware lossesOutRisk transfer. Insurance reduces the financial impact of an incident but does nothing to make a compromise less likely, so the 'reduce likelihood' constraint kills it.
- CDecommission the workstation now and purchase a replacement imaging systemOutThe overkill answer. Avoidance would remove the risk, but it contradicts the 18-month service requirement and a replacement that is not yet funded.
- DEnforce an application allow list so that only the imaging software and required system processes can executeAnswerHardening that blocks any unapproved executable from running, without needing a patch. It directly reduces the chance that a foothold turns into a compromise.
- EHave the risk owner sign a formal risk acceptance and record it in the risk registerOutRisk acceptance documents the decision and is good governance, but likelihood is exactly the same after the signature as before it.
The lesson: Read the verb in the goal: 'reduce likelihood' means mitigate, so transfer and acceptance fall away, and the stated timeline removes the replace-now answer.
Now do it at exam speed
The Security+ app has 3,000+ exam-style questions with an explanation for every option. Read each stem with the routine above and check whether your elimination matches the explanation.
App StoreGoogle PlayFree Security+ practice testKeyword decoder: what the stem is telling you
These phrases recur in Security+ stems. Each one narrows the answer before you read the options.
| When the stem says | It points to | Usually the wrong pick |
|---|---|---|
| Symptom to attack | ||
many accounts, one or two failed logins each | Password spraying: a few common passwords tried across many accounts to dodge lockout | Brute force, which piles many guesses onto a single account |
valid logins from two distant countries an hour apart | Impossible travel indicator: treat the account's credentials as compromised | Brute force; the logins succeeded, so the password was already known |
files renamed with a new extension and a payment note | Ransomware; isolate the host and restore from offline backups | Logic bomb, which is defined by its trigger, not by encryption and extortion |
database errors after unusual characters in a web form | SQL injection; fix with input validation and parameterized queries | Cross-site scripting, which runs in a visitor's browser, not against the database |
text message from 'IT' with a password-reset link | Smishing (SMS phishing) | Vishing, which uses a voice call |
caller posing as the help desk asks for an MFA code | Vishing with impersonation; verify through a known callback number | Smishing or email phishing; the channel here is a phone call |
lookalike domain one letter off the company name | Typosquatting, a form of brand impersonation | Watering hole, which compromises a real site the targets already visit |
connection fell back to an older, weaker protocol version | Downgrade attack; disable legacy protocol versions | Birthday attack, which targets hash collisions |
| Requirement to control | ||
stop / block / prevent | Preventive control: IPS, firewall rule, DLP in block mode | IDS, SIEM alert or log review, which only detect |
the usual control can't be applied, so use an alternative | Compensating control, such as segmentation around an unpatchable system | Corrective control, which restores things after an incident |
warning sign or login banner meant to discourage | Deterrent control | Preventive control; a sign discourages but physically stops nothing |
unknown laptops plugged into office wall ports | Network access control (NAC), such as 802.1X port authentication | DLP, which inspects data, not the devices joining the network |
detect, isolate and roll back malicious activity on endpoints | EDR, or XDR when correlating across more data sources | Signature-based antivirus alone |
realistic test data without exposing real values | Data masking or tokenization | Full-disk encryption, which protects stored data, not what testers see |
| Identity and crypto | ||
prove who sent it and that it wasn't altered | Digital signature: integrity plus non-repudiation | Encryption alone, which provides confidentiality |
one login for many applications | Single sign-on, typically through SAML or OAuth-based federation | MFA, which strengthens a login but does not reduce how many there are |
admin rights only for the length of a task | Just-in-time permissions in a privileged access management tool | Permanent membership in an administrators group |
| Response and risk | ||
infection confirmed on one host; what FIRST | Containment: isolate the host before eradication | Reimaging immediately, which destroys evidence and skips containment |
preserve evidence for possible legal action | Chain of custody and legal hold; collect the most volatile data first | Rebooting or wiping the system to clean it |
maximum acceptable data loss, measured in time | Recovery point objective (RPO); it drives backup frequency | RTO, which is how quickly service must be restored |
buy insurance / shift the cost to a third party | Risk transfer | Risk mitigation, which reduces likelihood or impact directly |
The qualifier words
The qualifier decides between options that all work. On the Security+ these words carry a specific meaning:
Name the most specific concept the evidence supports. A broader term from the same family is a deliberate near-miss.
Few tries on each of many accounts: password spraying, not brute force.
Pick the cause or attack the stated symptoms support, not one that needs details the stem never gave you.
Files encrypted right after a user opened an emailed invoice: ransomware by phishing, not a malicious insider.
Several options may help. Choose the one that meets every constraint with the most direct control over the stated goal.
Stop uploads of labeled files: a DLP block beats a faster SIEM alert.
An ordering question. Follow the incident response lifecycle, or the order of volatility for evidence, and pick the earliest step not yet done.
Malware confirmed on one laptop: isolate it before you wipe it.
Each chosen option must satisfy the stem on its own. Sounding complementary is not a reason to pick a pair.
Reduce likelihood on an unpatchable host: segmentation and an allow list, not insurance.
How the wrong answers are built
Distractors are not random. Most wrong options on the Security+ fall into one of these patterns:
Right family, wrong member
The tellTwo or more options from the same category: brute force and spraying, vishing and smishing, IDS and IPS.
Why it temptsYou recognize the category and stop reading. The specific detail in the stem is what picks the member.
The detector posing as a preventer
The tellThe option alerts, logs or reports when the stem says stop, block or prevent.
Why it temptsSIEM rules, IDS signatures and log reviews are familiar and feel proactive, especially when the option promises speed.
The policy answer
The tellA policy, training or acceptable use update offered where the stem asks for a technical control.
Why it temptsPolicies are always good practice, so they never look wrong. They are right when the gap is governance, wrong when the stem needs a technical stop.
The overkill fix
The tellReplace, rebuild, shut down or block everything, beyond what the stem asks and often against a stated constraint.
Why it temptsIt removes the risk completely, which feels like the most secure answer even when the business cannot accept it.
The right step at the wrong time
The tellA valid action placed out of order: eradicating or reimaging before containing, remediating before identifying.
Why it temptsEvery step listed is real. Only the qualifier FIRST or NEXT makes it wrong.
Time budget by question type
| Question type | Budget | Tactic |
|---|---|---|
| Performance-based questions (simulations) | About 5 min each on the first pass | Security+ uses simulation PBQs, which CompTIA says you can skip and return to; your work is saved when you move on, and Reset clears only that item. Candidates commonly meet them at the start. If one stalls, enter what you are sure of, press Next, and finish it after the multiple-choice items. |
| Short identify-the-concept items | 30-45 sec | One or two sentences of symptoms and BEST describes. Map the symptom phrase with your lexicon, check for a more specific sibling option, answer and move on. |
| Scenario items asking for a control, cause or step | 60-90 sec | Read the ask first, mark constraints, strike noise, eliminate by constraint, then let the qualifier rank what is left. |
| Select TWO items | About 90 sec | Test each option against the stem independently. If three look plausible, a constraint you skimmed past kills one of them. |
How to practise reading, not just content
Knowing the material is half of it. These drills train the reading:
Lexicon flash pairs
Write each symptom phrase on one side of a card and the attack or control on the other. Once the mapping is instant, mix in near-miss pairs such as smishing and vishing, IDS and IPS, RPO and RTO, and drill until you can say what separates them.
Strip the stem
Take any practice question and rewrite the stem in ten words, keeping only symptoms and constraints. If your answer changes, you cut a constraint. If it does not, everything you removed was noise.
Name the killer
For every wrong option in a practice set, write down the exact phrase in the stem that eliminates it. If you cannot point to one, you do not yet know why it is wrong, and that is the topic to review.
The Security+ at a glance
| Questions | Maximum of 90 |
| Time | 90 minutes |
| Passing score | 750 on a 100-900 scale |
| Question types | Multiple-choice and performance-based (simulation PBQs) |
| Going back / flagging | Next/Previous buttons; simulation PBQs can be skipped and revisited, with work saved |
| Fee | US$439 exam voucher (CompTIA list price) |
| Delivery | Pearson VUE test center or online via OnVUE |
Practise the reading, not just the facts
Work Security+ questions by domain on the app or try the free practice test. After each miss, find the phrase in the stem you read past.
App StoreGoogle PlayFree Security+ practice testFAQ
Are these real Security+ exam questions?
No. The three scenarios here are original, written against CompTIA's published SY0-701 objectives in the style of the exam. CompTIA keeps live exam content confidential, and memorizing leaked items breaks its candidate agreement without teaching the reading skill anyway. Use them to practise decoding: find the symptom, the constraint, the noise and the qualifier, then name the phrase that kills each wrong option.
Do the PBQs come first, and should I skip them?
Candidates commonly report seeing performance-based questions at the start, though CompTIA does not publish item order. Security+ uses simulation PBQs, and CompTIA states you can skip a simulation PBQ and return to it later, with your work saved when you move on. A sensible plan: give each a few minutes, enter what you are sure of, press Next if it stalls, and come back once the multiple-choice items are done. CompTIA says some PBQs may offer partial credit.
Is a score of 750 the same as 83 percent?
No. 750 is a scaled score on a 100-900 range, and CompTIA does not publish a percentage equivalent. CompTIA also says some performance-based questions may carry higher point values than others and some may offer partial credit, so you cannot work out a percentage from a count of correct answers. Aim to understand every objective rather than to hit a target percentage on practice tests.
Should I take SY0-701 or wait for SY0-801?
CompTIA lists Security+ V8 (SY0-801) as launching on or around November 17, 2026, in English, and SY0-701 retiring on June 11, 2027 in English and August 13, 2027 in Japanese, Portuguese, Spanish and Thai. If you are already studying for SY0-701, you have until then to sit it. CompTIA says V8 expands coverage of areas such as AI-related risks. The reading habits on this page apply to both.
Why do I pick answers that are technically right but marked wrong?
Because Security+ ranks options. Several choices are often true statements, but BEST describes wants the most specific concept, MOST likely wants the cause the evidence supports, and FIRST wants the earliest correct step. When you miss one, find the phrase in the stem that separates your choice from the key: a count of accounts, the word prevent, or a must-remain-in-service constraint. That phrase is what you read past.
Sources
Figures on this page come from CompTIA and the other primary sources below:
- CompTIA Security+ V7 (SY0-701): exam details and objectives summary
- CompTIA Security+ V8 (SY0-801): launch date and exam details
- CompTIA: Performance-Based Questions explained
- CompTIA: Performance-Based Question FAQs
- CompTIA: Schedule your exam (Pearson VUE test center or OnVUE)
Checked October 14, 2026. Fees, outlines and eligibility rules change — confirm with CompTIA before you book.