Question 1Objective 4.1
Which control is designed to inspect HTTP requests and block SQL injection and cross-site scripting before they reach a web application?
Security+ performance-based questions
Performance-based questions ask you to do a task: read logs, order incident steps, match attacks to controls or fix a configuration. They usually appear first and take the longest.
| Questions | Up to 90, multiple choice and performance-based |
|---|---|
| Time | 90 minutes |
| Passing score | 750 on a scale of 100 to 900 |
| Our labs | Firewall rules, logs, incident response, email records, access review, attacks to defenses |
What the tasks look like
- A ruleset or table to read, then a rule to fix or reorder.
- Log lines to inspect for an attack, then the right response.
- Items to drag into order, such as incident response phases or evidence collection.
- Attacks, controls or protocols to match to each other.
How to pace them
Read the task once. If it will clearly take more than a few minutes, flag it, answer the multiple-choice questions, then come back. A wrong answer costs nothing, so never leave one blank.
Practice the skills, not the screens
CompTIA's own task screens are not public, so our labs teach the skill each task tests: reading a firewall ruleset from the top, spotting a brute-force burst in a log, or fixing a DMARC policy.
Try 3 questions
Question 2Objective 2.5
A web log shows a request with the parameter user=admin' OR '1'='1. What attack is being attempted?
Question 3Objective 4.1
A domain owner wants receiving servers to reject messages that fail SPF and DKIM alignment, and to send reports about them. Which record does this?
Next step
Questions people ask
How many performance-based questions are on Security+?
CompTIA does not publish a fixed number. The exam has up to 90 questions in total, a mix of multiple choice and performance-based.
Can I skip a performance-based question?
You can flag it and return later within the 90 minutes. Answer it before time runs out; blanks score nothing.
Are your labs the real exam tasks?
No. They are original tasks built to practice the same skills in the browser.