CompTIA Security+

Security+ uses both multiple-choice and performance-based questions (PBQs). PBQs appear first and simulate real-world tasks like configuring firewalls or analyzing logs. Skip them initially if stuck — flag and return after completing the multiple-choice questions.

Security Operations is the largest domain at 28%. Focus heavily on SIEM, log analysis, incident response procedures, and security monitoring. Know the difference between IDS and IPS, and when to use each.

Cryptography is the hardest topic for most candidates. Know symmetric (AES, DES) vs asymmetric (RSA, ECC), hashing algorithms (SHA-256, MD5), digital signatures, and the full PKI certificate lifecycle.

The exam loves scenario-based questions. When you see 'which is the BEST approach' or 'MOST effective control,' eliminate answers that are technically valid but don't fit the specific scenario described.

Know the threat actor categories and their motivations: nation-state (espionage, disruption), organized crime (financial gain), hacktivists (ideology), insider threats (access), and script kiddies (notoriety).

Identity and access management is heavily tested. Understand MFA factors (something you know/have/are), the difference between authentication and authorization, and protocols like SAML, OAuth, and LDAP.

Governance and compliance questions require knowing frameworks by name: NIST CSF for cybersecurity, NIST 800-53 for controls, ISO 27001 for ISMS, PCI DSS for payment data, HIPAA for healthcare, GDPR for EU privacy.

You get 90 minutes for up to 90 questions — time is tight. Spend no more than 1 minute per multiple-choice question on your first pass. Budget 15-20 minutes at the end for PBQs and flagged questions.