Pass it on your FirstTry.

Full-length practice exams for CompTIA, AWS, Microsoft, Cisco and more.

Every answer names the official page it came from.Never recalled from a real exam.

Find your exam See how we write them

Five free questions on every practice exam. No account, no card.

Certifications we offer

Browse every exam in the catalog

01 /

Sit the exam here, before you pay to sit it there.

The exam room

The screen you sit a form on, running here: the real clock, the real navigator, the real question card. Nothing below is a picture of the product.

firsttry.app/practice/security-plus/session

Try it: Security+ under exam conditions

SY0-701

Sample data

A live demo. The screens below, and the scoring and cut score behind them, are the real product; only the practice answers are invented, so no result here is anyone’s real result.

SY0-701Exam conditions

23 of 90

5-2Security Program Management and OversightModerate

A team deploys a firewall rule that makes a known injection threat harder to exploit, without removing the vulnerable code or involving a third party. Which risk strategy is being applied?

22 of 90 answered

That is the whole exam-conditions contract: your answer is recorded and nothing is revealed until the form is submitted. What opens at submit is the rest of this page.

Then it scores that form against the published cut line, and says if you're ready to book.

Two readouts, because they answer different questions. The score is this one form; readiness is every answer so far. One form can go either way, so readiness is what decides when you book.

Estimated scaled score, this sitting

688Not there yet

750 to pass

100900

You are 62 points from the 750 line. The report below shows exactly where those points are.

66 of 90 correct. The score above is our estimate, not a vendor score: harder questions and performance-based tasks count for more, mapped onto the published 100 to 900 scale and the 750 cut score. The real model is not published, so read it as a guide, not a prediction.

Readiness, every answer so far

Exam ready starts at 80%.

180 answers across every domain, weighted to the published blueprint and discounted as they age.

Neither line is cleared yet, so the answer today is more practice.

Score report, this sitting

Domain, weakest firstWeightCorrectAccuracy

Every explanation ends in a page you can check.

Every question in the bank carries the same three tiers, and the link at the bottom of the card is the vendor page the answer was checked against. Open it and check us.

Five certifications

The concept: The principle the item is testing, stated before any answer is named.
Why the answer follows: How the right option comes out of that principle, not that it is B.
A note on every option: The correct one included, each wrong one with the question it would have been right for.

How we write and verify questions

CompTIA Security+

SY0-701

2-1Threats, Vulnerabilities, and MitigationsModerate

Three staff in one finance team receive messages referencing a real supplier invoice and their manager by name. No other department is contacted. What does the targeting indicate?

A mass campaign that happened to reach financeA mass campaign optimises for volume, so it would not stop at one department and would not carry details specific to this organisation.

An automated scanner enumerating mail serversEnumeration finds hosts and addresses. It produces no content, and the question is about what the message body knows.

An attacker who researched the organisation firstCorrect · your answerCorrect.

A misconfigured filter releasing quarantined mailA filter failure would release mail of every kind, including the untargeted bulk that makes up most of it.

Correct.

Concept

Social engineering delivered electronically splits along how much the sender knows about the recipient. Untargeted campaigns go wide and cheap, accepting a low response rate. Targeted ones cost reconnaissance time up front and buy plausibility with it, which is what raises the response rate enough to justify the effort.

Why C

A real supplier, a named manager and a single department are all details that have to be gathered before the message is written. That is spearphishing, and the narrow blast radius is the tell.

Source

MITRE ATT&CK T1566, Phishing Answer verified against attack.mitre.org, August 2026.

#phishing#spearphishing#threat-actors#social-engineering

The bank, measured

What the bank actually holds.

Counted from the serving bank on this build, not written into this page. A bank collected from test takers has no official page to cite and no note to count.

verified questions: 4,251; Serving today. Each one is original, written from the published objectives, and checked against an official page before it serves.
explanation notes: 25,807; The concept, the answer, and a note on every single option. Nothing in the bank is a bare answer key.
official pages cited: 1,367; Unique vendor documentation pages the explanations link to. A question collected from a test taker has nothing to cite.
certifications covered: 58; Each one has a bank written to its own published objectives. A certification we have not written yet is listed as planned and counted nowhere.
full-length practice exams: 61; Assembled to the published domain weightings and scored on the real cut score. A partial form is never emitted.

02 /

Buy one cert, or all of them.

A single certification is $49 once and does not expire. A whole sequence is a certification path, bought as one purchase. No countdown timers, no fake sales, and no price that is different tomorrow.

Every explanation is free. Always.

Three tiers on every question, with the official page each answer rests on, open to everyone at every tier. Nothing here buys an explanation. Free gives you questions. Pro tells you what to study next.

Free

Get started

See whether the questions are any good before you spend anything.

Full explanations on every question
All three tiers, with the official page the answer rests on, on every question you are shown.
30 questions a day per certification in bank practice, from a free set of 50
10 questions per certification in bank practice, with no account. The free set is apportioned to the published domain weights, so it spans the blueprint.
All cheat sheets
Every one on the site, and every one we add later. Nothing about them is metered.

Create free account

Pro

Rent every certification

$19/ month

Every certification while you pay, and nothing to decide up front. Stop any month.

Every practice exam on every certification
Full length and weighted to the published blueprint. Sit any of them under exam conditions or in study mode.
No daily limit on any certification
Quick practice, domain drills and review missed all draw on the whole bank, not the free set of 50.
Everything published while you subscribe
New certifications, and new practice exams on the ones already here, with nothing more to pay.
Anything bought outright stays yours
Pro runs while you pay for it. A certification you bought once is still there after you stop.

Go Pro

Single certification

Own one exam

$49once

Most people are taking one exam. This is that.

Every practice exam on that certification
Full length and weighted to the published blueprint, with all three explanations on every question.
Exam conditions or study mode, on every form
Chosen before each sitting: a clock and no feedback until you submit, or the explanation after every answer.
No daily limit on that certification
Quick practice, domain drills and review missed all draw on the whole bank, not the free set of 50.
Bought once, kept
The practice exams we add to that certification later are included. Nothing renews and nothing expires.

Choose a certification

Every certification, once

All Access, for good

$199once

Limited to the first 500 founding accounts.

Claim a founding spot

The full pricing page compares every tier line by line.

03 /

Questions, answered.

What people ask before they start, answered plainly. The full positions live on the refunds and privacy pages.

Are these real exam questions?

No, and that is the point: every question is original, written from the vendor's published objectives and checked against an official page recorded on the question. Sites that sell questions collected from recent test takers are selling a breach of the agreement you sign before you sit, and it can cost you the credential.

What do I get without paying?

Five questions from across every practice exam, with the full explanation on each. That holds on every certification, and it needs no account and no card. All cheat sheets are free too, and bank practice draws from a free set of 50 questions per certification, 30 a day with a free account.

Do I have to pay to see the explanations?

Never: explanations are free on every question at every tier, including anonymous. We meter how many questions you answer, not what you are allowed to learn from them.

Can I get a refund?

Lemon Squeezy is the merchant of record, so refunds run under their policy and the consumer rights that apply where you live, and nothing we write reduces those. Write to us and we will help.

Does my access expire?

A single certification and a path bundle are bought once and kept, including every practice exam we add to that certification later. Pro is the one subscription and runs while you pay; All Access does not expire.

Will there be countdown timers or fake sales?

No, and there never will be: no countdown timers, no manufactured urgency, no popups, and no user counts until they are real numbers we can show. The one counter on the site is founding spots remaining, a live count from our database.

Ready when you are.

Five free questions on every practice exam, with the explanation on each one. No account, no card.

Find your exam See pricing