How we write Security+ practice questions

1. Start from the objectives, in our own words

We map each of the 27 SY0-801 objectives into our own topic map: what it tests, at what level, the near-miss ideas that make good wrong answers, and the primary sources to cite. We describe the objectives in our own words and never copy CompTIA’s.

Every question is written from scratch to that map. We never use real, recalled or leaked exam questions, and we never adapt questions from books, courses or other practice sites. Each question is tagged to exactly one objective and topic, and labeled with the exam version it was written for.

2. Write to a written benchmark

Each question type has its own written quality benchmark: single-answer questions, “choose two” questions and six PBQ formats. Among its rules:

• Options of similar length, all from the same category, and never “all of the above”.
• A short scenario when the objective calls for one, ending in a clear question.
• A qualifier such as BEST or MOST likely only when two options could be right in some situation.
• No trick wording, double negatives or sentences that aren’t needed to answer.
• Every port, protocol and event ID checked against a verified reference list.

The benchmark guards against two kinds of bad question: ones that are too easy because the wording gives the answer away, and ones that are too hard for the wrong reasons. We use AI models to help draft questions to this brief. All 552 published questions passed every step below before release.

3. Automated validation

A validation script checks every question before review. Among other things, it flags:

• a correct answer that is noticeably longer than the wrong ones;
• words such as never or always that appear only in wrong options;
• duplicate options, and questions that are too similar to others in the bank;
• port numbers and event IDs that don’t match our verified list;
• firewall PBQs whose expected answer fails when test connections are run through it;
• sources from sites we don’t allow, such as exam-dump and competitor sites.

5. Approved by our editor

Our editor reads every question with its key marked and every change listed, then approves it, edits it or sends it back. Only approved questions go into the question bank.

For every question we keep a record of how it was drafted, reviewed, edited and approved, and when. That record is part of how we show each question is original.

6. Every option gets a reason

Each option has its own one-to-three-sentence rationale tied to the facts in the scenario, and each wrong option targets a real misunderstanding. Every question also has a short explanation, a one-line takeaway, and one to four sources.

Sources are primary material wherever possible: NIST and CISA publications, MITRE ATT&CK, CAPEC and CWE, FIRST’s CVSS documentation, IETF RFCs and vendor documentation. OWASP pages are linked, never copied.

7. Difficulty estimates and future calibration

Until we have learner data, a question’s difficulty is a model estimate: the share of minimally qualified candidates we expect to answer it correctly. We picture someone about two years into a security administrator role who would just pass. Two review passes rate it independently, and we average their ratings; when they disagree a lot, a third rating breaks the tie.

Response-based calibration is not built yet, so every rating is still an estimate. The intended process is to compare estimates with how people actually answer. We look for warning signs after 30 first attempts, such as a question that strong test-takers miss more often than weaker ones, which can mean a wrong answer key. After 150 first attempts we decide whether to keep, revise or retire each question.

8. Corrections in public

Found a mistake? Report it. We check reports against sources, fix what’s wrong and log every correction in our public changelog with the date, the question ID, what changed and why.