Security+ SY0-701 Format, Passing Score and PBQs

The CompTIA Security+ SY0-701 exam has up to 90 questions, a 90-minute time limit, and a passing score of 750 on a scale of 100 to 900. The questions are a mix of multiple choice and performance-based questions (PBQs). This article explains what that means in practice and how to approach the PBQs without losing time.

SY0-701 exam at a glance

These figures come from the exam page and objectives on comptia.org. Confirm them there before you book, because CompTIA can update details such as pricing, languages and delivery options.

How the passing score works

The 750 is a scaled score, not a percentage. CompTIA converts your raw performance to a 100 to 900 scale so that different exam forms, which can vary slightly in difficulty, are scored comparably. That has two consequences you should plan around:

• You cannot convert 750 into a fixed number of correct answers. Anyone who tells you that you need exactly 83% (or any other figure) is guessing. CompTIA does not publish a raw-score cutoff.
• Treat every question seriously. You cannot tell how individual items are weighted, so give each one a real attempt and avoid leaving any blank.

You receive a pass or fail result with a score report, and CompTIA's score reports include performance feedback by exam area, which helps if you need to plan a retake. Every retake costs the full voucher price; see what Security+ costs, including retakes.

What a multiple-choice question looks like

Most questions are short scenarios followed by four or five options. Some ask you to pick the single best answer; others say "select TWO" or "select THREE". Read that instruction carefully, and select exactly the number requested; CompTIA does not publish how partial answers are scored, so do not count on partial credit.

A typical item reads like this: a company wants employees to prove their identity with a code from an app on their phone in addition to their password. The correct reasoning is that this adds a second factor (something you have), so the control is multifactor authentication. Notice that no definition is requested; you must recognize the concept inside a business situation.

What performance-based questions are

Performance-based questions put you in a simulated task instead of asking you to choose from a list. CompTIA describes them as testing whether you can apply knowledge in a practical setting. Formats you should be ready for include:

• Drag and drop: match controls to threats, place steps of the incident response process in order, or put devices in the correct network zones.
• Matching and dropdowns: choose the correct attack, protocol or remediation from a menu for each line of a scenario.
• Configuration simulations: for example, writing or ordering firewall rules, or selecting settings to harden a device or wireless network.
• Log or output analysis: reading a log excerpt or scan result and identifying what happened or what to fix.

A repeatable method for PBQs

PBQs are commonly encountered near the start of the exam, and they can take several minutes each. The exam interface lets you flag questions and return to them, which is the key to managing time.

1. Skim, then decide. Spend about 15 seconds reading the task. If it is a topic you know well, do it now. If it looks long or unfamiliar, flag it and move on.
2. Do the multiple-choice questions first. They are quicker, and the points are just as real. Answering them also warms up your recall.
3. Return with time and context. Questions you worked on later sometimes jog your memory about a PBQ topic.
4. Read every instruction line.PBQs often have constraints such as "use each option once" or a specific goal like "block the attack while allowing web traffic".
5. Make a best attempt on everything. A partially reasoned answer is better than an empty one. Do not spend ten minutes chasing one perfect configuration.
6. Check your final state before submitting. In drag-and-drop tasks, confirm that items are actually in their target slots; in firewall tasks, re-read the rule order and action.

A worked PBQ-style example

Suppose you are given a firewall rule table and told that an internal host must reach external websites over HTTPS and resolve names, but nothing from the internet may reach internal systems. A strong approach:

• Allow outbound TCP 443 (HTTPS) from the internal network.
• Allow outbound DNS, which uses UDP and TCP port 53.
• Finish with an explicit deny-all rule, since firewalls process rules top to bottom and implicit or explicit deny is the safe default.

Knowing the ports and the "first match wins" behavior is the whole task. That is why memorizing the common ports, which we list in the Security+ cheat sheet, pays off.

Time management for the whole exam

With up to 90 questions in 90 minutes you have, on average, under a minute per item, and PBQs will take more than that average. A practical pacing plan:

• Aim for roughly 45 to 60 seconds on a typical multiple-choice question.
• Flag anything you would need more than a minute for, and keep moving.
• Reserve the last 10 to 15 minutes for flagged questions and any PBQs you skipped.
• Never leave a question unanswered; there is no benefit to blank answers.

How to practice the format

Reading about PBQs is not the same as doing them. Use practice material that includes structured question types such as dropdown, drag-and-drop and ordering formats, and time yourself in blocks of 30 to 45 minutes. CompCertQuiz practice questions are original material, not CompTIA content, and the free SY0-701 set lets you try both multiple-choice and structured formats before deciding whether the full bank is worth it. To avoid losing points on look-alike answers, read the common Security+ exam traps.

Frequently asked questions

How many questions are on the Security+ SY0-701 exam?

There is a maximum of 90 questions. The exact number can vary from one test taker to another, and the set includes both multiple-choice and performance-based questions.

What is the passing score for Security+ SY0-701?

750 on a scale of 100 to 900. It is a scaled score, so it does not equal a fixed percentage of correct answers.

How long is the SY0-701 exam?

The time limit is 90 minutes for up to 90 questions.

Should I do the performance-based questions first?

Many candidates flag them and return after the multiple-choice questions, because PBQs consume the most time per item. If a PBQ is on a topic you know well, doing it immediately is fine. The important part is to avoid sinking more than a few minutes into any single one on the first pass.

Can I skip questions and come back?

Yes. The exam software lets you flag questions and review them before you finish, so use that to protect your time.

Is the format changing with SY0-801?

CompTIA has announced Security+ V8 (SY0-801) for November 2026. Format details for the new version should be taken from the CompTIA Security+ V8 page; do not assume SY0-701 numbers carry over.