CompTIA Security+ demo
Try it before you sign up.
This is an exam-style performance-based question for Security+ SY0-801, running on the same engine as the course. Do the task, check your score, read the explanation. No account, no card.
Performance-Based Question
Write the Zone Firewall Rules
Scenario
A veterinary hospital is moving from one flat network to four security zones: staff, guest Wi-Fi, servers and management. One core firewall routes between the zones and to the internet. Its rule table is empty, so for now it blocks everything. Write the rules from the IT lead's zoning policy.
On: the question appears on a copy of CompTIA's test screen. Off: the same question in ExamWizardz styling.
These instructions stay visible beside the lab while you work.You can reread these instructions in the lab at any time.
More free PBQs are open to everyone at /pbq-practice. The full CompTIA Security+ library is 44 PBQs and labs.
Then there are the labs.
Work on a simulated Ubuntu server or Windows machine: harden the box, write the firewall rules, and get graded on what you actually changed. These two are free to play here, no account needed.
Harden the Linux Web Server
Copperline Tile Supply sells floor tile from one Ubuntu web server, copperline-web01. Priya Nair, an outside auditor, reviewed it last week and sent back this findings list:
- Telnet answers on TCP port 23. Nobody has used it in years. - SSH accepts passwords. The baseline says PasswordAuthentication must be no. The team signs in with SSH keys. - netcat (the nc command) is installed, and nobody on the team knows who put it there. - /etc/shadow can be read by every account on the server. The baseline says it must be mode 640, owned by root, group shadow. - Root can sign in over SSH. The baseline says PermitRootLogin must be no.
Close all five findings. Uninstall netcat; don't just hide the command. Root must not be able to sign in over SSH at all, with a password or with a key: set PermitRootLogin to no, not prohibit-password. Port 23 must be closed now and must stay closed after the server reboots. The SSH changes must be live on the running server, not only saved in a file. Two things must keep working: the shop's website, which Apache serves on TCP port 80, and SSH on port 22, which the team uses to run the server.
The server is at its boot menu. Log in as Bench Technician with the password Tech!23; sudo asks for the same password. The Terminal is on the dock.
Write the Host Firewall Rules
Kestrel Ridge Freight's yard office PC does two jobs besides its own. It hosts the dispatch board, a small internal web app that staff open over HTTPS (TCP 443), and a shared folder that staff map over SMB (TCP 445). Staff PCs sit on the office LAN, 192.168.10.0/24. The PC is joined to the company domain and is on the domain network today, but the yard supervisor takes it to customer sites and joins their guest Wi-Fi, which Windows treats as a public network. The IT admins work from 10.20.0.0/24.
A security review of the PC's Windows Defender Firewall found: • The vendor who installed the dispatch board left a rule named "Allow Any Inbound" that lets every inbound connection through on every profile. Delete it. Staff must still reach the dispatch board from the office LAN, through an inbound rule of its own that allows HTTPS. • Remote Desktop (TCP and UDP 3389) answers anyone who can reach the PC. Only the IT admin subnet, 10.20.0.0/24, may connect, on any network, and the admins must keep their access. • SMB must be blocked whenever the PC is on a public network, including from other devices on the same guest Wi-Fi. Staff on the domain network must keep their shared folder. The PC has no use for file sharing on a private network, so SMB there is your call. • The private and public firewall profiles are switched off. Every profile must be on.
Use any Windows tool you like; a terminal changes the firewall only when elevated (right-click Start, choose Terminal (Admin), then select Yes). Grading is on the firewall's final state.
Practice exams that feel like the real one
830 exam-style questions with an explanation for every answer. Short section quizzes while you learn, timed full mocks when you are close, and a breakdown that shows which sections cost you points.
A network administrator passed Security+ and wants to keep the certification active without sitting the exam again. Which statement about renewal is accurate?
Security+ is valid for three years from the day it is passed, and it renews by earning 50 continuing education units in that window and paying the renewal fee; earning a higher-level CompTIA certification such as CySA+ also renews it. It doesn't last for life or for five years, and retaking the exam is only needed if the certification is allowed to lapse.
The first item on a candidate's Security+ exam is a long performance-based simulation that she isn't sure how to approach. Which approach BEST uses her exam time?
CompTIA lists Security+ PBQs as simulations that save your work, so a widely used approach is to skim them, flag the long ones, answer the multiple-choice questions and come back with the time left. Simulations are scored, some can award partial credit, and Security+ simulations can be left and revisited, so skipping, rushing or treating one as a one-way door all cost points.
A candidate with two weeks left before the exam wants to prepare for performance-based questions. Which objectives should get the MOST hands-on practice?
Given-a-scenario objectives expect you to apply a concept, and they are the natural source of performance-based questions; on SY0-801 they include identity and access management, indicators of malicious activity and security awareness. Explain and summarize objectives are mostly tested with knowledge questions, and neither a domain's size nor an objective's position decides where PBQs come from.
Lessons in exam order
148 written lessons follow the official objectives one section at a time, in plain language, with the section's practice and PBQs at the end. Video lessons are on the way.
Security+ is the certification most people earn when they move from general IT into security work. Hiring managers use it as a baseline, and the U.S. Department of Defense uses it to qualify people for a long list of cyber and IT roles. Before you study a single control or attack, it helps to know exactly what the exam asks of you.
Flashcards, one deck per section
1,215 cards. Six of them are below, from the SY0-801 acronym deck.
A plan with a date on it
Pick an exam date and how long you can study. This is the same arithmetic the app runs on CompTIA Security+: every lesson, lab and mock, at your pace.
CompTIA Security+ on ExamWizardz today: 830 questions, 148 lessons, 44 PBQs and labs, 1,215 flashcards. Counted from the library, not a marketing sheet.
Start with lesson 1. Pay only if it works.
The free plan opens the first 4 sections of the CompTIA Security+ course and a free mock each month. Pro unlocks the whole library, month to month, with a 30-day guarantee. One Pass Plan covers every course.
Free plan · No credit card · Cancel anytime