Free tool · No sign-up needed
5 free, original PBQs for SecurityX (CAS-005), with firewall rules and drag-and-drop. Do each task, check it, and read why the answer is right.
Last updated
CompTIA SecurityX
You do each task instead of picking an answer. Every question is explained after you check it, and you get a score at the end.
Take it further in OpenpassAI
OpenpassAI’s practice sessions add performance-based questions, with command-line and network topology tasks, to full timed exams, AI explanations and a readiness score.
The questions
Each one with its scenario and task. Try it above first, then open the explanation.
Question 1 · Matching · Governance, Risk, and Compliance
A database server is valued at $200,000. A ransomware incident is expected to destroy 25% of that value, and one is expected once every four years. A proposed control costs $5,000 a year and would halve how often the incident happens.
Match each quantity to its value.
Single loss expectancy is asset value times exposure factor: $200,000 × 0.25 = $50,000. Once every four years is an annualized rate of occurrence of 0.25. Annualized loss expectancy is SLE × ARO: $50,000 × 0.25 = $12,500. Halving the rate to 0.125 gives an ALE of $6,250. The control’s yearly net benefit is the ALE before, minus the ALE after, minus its cost: $12,500 − $6,250 − $5,000 = $1,250, so it pays for itself, narrowly.
Question 2 · Firewall rules · Security Architecture
A retailer is preparing for a payment card assessment. The cardholder data environment holds a payment application and the card database. Today the whole corporate network can reach it, store terminals can reach the database directly, and the payment application can’t reach its own database through the firewall. Administration should go through the jump host only.
Edit the rules until all six requirements pass. The first matching rule decides, and anything unmatched is denied.
Remove the rule that lets the corporate network into the cardholder data environment: keeping systems that don’t need card data out is what reduces the assessment’s scope. Narrow the terminals’ rule to the payment application on port 443, add the payment application’s path to the database, and give administrators one route in from the jump host. Every remaining path is closed by the implicit deny.
Question 3 · Ordering · Security Engineering
A new public web server needs a TLS certificate from a certificate authority. The runbook’s steps have been shuffled.
Arrange the six steps from first to last.
The key pair is generated on the server, and the private key never leaves it. The certificate signing request carries the public key and the names the certificate should cover. The certificate authority checks that the requester controls the domain before it signs. The server then needs the certificate and the intermediate chain, so browsers can link it to a root they trust. Renewal is scheduled at the start, because an expired certificate is an outage.
Question 4 · Matching · Security Engineering
A design review lists six requirements, and each calls for a different kind of cryptography.
Match each requirement to what meets it.
Symmetric encryption such as AES-256 is fast enough for bulk data. A key exchange such as ECDHE lets two parties agree on a key that an eavesdropper can’t work out. A hash shows that data hasn’t changed, and a digital signature adds proof of who signed it. A key derivation function such as Argon2 is deliberately slow, so guessing stored passwords is expensive. Homomorphic encryption allows calculation on data that stays encrypted. MD5 is broken for security use, and Base64 is an encoding, not encryption.
Question 5 · Sorting · Security Operations
You’re building the timeline of an intrusion from eight observations, using the tactic names from the MITRE ATT&CK framework.
Put each observation under the tactic it shows.
Initial access is how the attacker first got in: here, a phishing attachment and an exploited VPN appliance. Persistence is what keeps them in after a restart or a password change, such as a scheduled task or a new administrator account. Lateral movement is spreading from one machine to others. Exfiltration is getting the data out. Placing each observation on the timeline shows which stages your defenses saw and which they missed.
CompTIA lists SecurityX as having both kinds of performance-based question: simulations, and virtual environments that run full versions of the software. CompTIA’s page on performance-based questions, read on November 12, 2026.
Guide
CompTIA describes performance-based questions as exam items that test your ability to solve problems in real-world settings. Most are simulations: an approximation of a tool such as a firewall, a network diagram, a terminal window or an operating system.
You don’t pick an answer. You do the task, and there can be more than one correct way to do it.
Try each question cold. Getting it wrong first and then reading why teaches more than reading the answer and nodding along.
A right answer reached by guessing is a wrong answer waiting for exam day. Every question here explains why each part is what it is.
CompTIA says a simulation question can be skipped and returned to later, with your work saved. If one is eating your time, move on, answer the multiple-choice questions and come back.
14 free labs in your browser: Linux and Windows command line, firewall rules and SOHO router setup, checked as you go.
Open the toolFree performance-based questions for 19 CompTIA exams: firewall rules, network diagrams, command-line tasks and drag-and-drop.
Open the toolFree practice tests for 261 popular certification exams, with explanations and a score by exam domain.
Open the toolFAQs
Find quick answers or contact our support team.
Yes. CompTIA lists SecurityX as having both kinds of performance-based question: simulations, and virtual environments that run full versions of the software. That is from CompTIA’s page on performance-based questions, read on November 12, 2026.
No. They’re original tasks written to each exam’s published objectives. Using leaked real exam questions breaks every vendor’s exam rules.
CompTIA says a performance-based question can have more than one correct way through it, that its scoring allows for the different approaches, and that partial credit may be given. Here, each question is scored by its parts, so you can see which part you missed.
CompTIA says a simulation question can be skipped and returned to later, and that your work on it is saved when you move on. A virtual-environment question has to be completed when you reach it: a warning screen tells you so first.
No. The questions run in your browser and nothing is saved. Sign up only if you want full practice exams and progress tracking.
OpenpassAI
Hi 👋 I’m OpenpassAI. Ready to prepare for your exam the smarter way?
Ready to explore OpenpassAI? I can show you how the platform helps you prepare, practice, and pass.
