
Measured data
CompTIA Security+
We scored 90 real CompTIA Security+ exam questions 1-10 on question complexity and broke the result down by exam domain.
- 90 questions scored
- 5 domains
- 2.2/10 overall complexity
Complexity by exam domain
Higher scores mean more demanding question formats. The exam score is computed over the whole bank, not averaged across domains.
- General Security Concepts11 questions · complexity 2.0/10 · Gentle
36% multi-select · 0% scenario · 27% interactive
- Security Architecture17 questions · complexity 2.0/10 · Gentle
35% multi-select · 0% scenario · 29% interactive
- Security Operations24 questions · complexity 2.0/10 · Gentle
33% multi-select · 0% scenario · 33% interactive
- Security Program Management and Oversight18 questions · complexity 3.1/10 · Gentle
61% multi-select · 0% scenario · 33% interactive
- Threats, Vulnerabilities, and Mitigations20 questions · complexity 2.0/10 · Gentle
35% multi-select · 0% scenario · 30% interactive
Full per-domain breakdown
Blueprint weight, bank size and question format mix for every domain of the exam.
| Domain | Blueprint | Questions | Single | Multi | Interactive | Complexity |
|---|---|---|---|---|---|---|
| General Security Concepts | 12% | 11 | 4 | 4 | 3 | 2.0/10Gentle |
| Security Architecture | 18% | 17 | 6 | 6 | 5 | 2.0/10Gentle |
| Security Operations | 28% | 24 | 8 | 8 | 8 | 2.0/10Gentle |
| Security Program Management and Oversight | 20% | 18 | 6 | 6 | 6 | 3.1/10Gentle |
| Threats, Vulnerabilities, and Mitigations | 22% | 20 | 7 | 7 | 6 | 2.0/10Gentle |
How the score is calculated
The formula is fixed and public, so anyone can reproduce these numbers from the same bank.
Every question in the CompTIA Security+ bank is measured on four signals that can be read directly from the database. Each signal is expressed as a share of the questions in the domain, and the four shares are combined with fixed weights:
- Multi-select questions (40% weight). Items with more than one correct answer. The candidate has to find all of them, which is the single hardest format in the bank.
- Scenario questions (30% weight). Questions longer than 150 characters, which describe a situation instead of a definition and therefore test reasoning rather than recall.
- Interactive questions (20% weight). Items that require reading code or a configuration snippet.
- Deep explanations (10% weight). Questions whose explanation runs past 300 characters, which signals a concept with real nuance behind it.
The combined share is multiplied by ten to produce a 1-10 score. The exam-level score is computed over the whole bank rather than averaged across domains, so a small domain cannot distort the total. Figures on this page are recomputed from the live bank on every crawl.
Data set: Certilum CompTIA Security+ Foundation question bank, 90 questions, 5 domains. Published by CERTILUM. This is Certilum’s own measurement of its own question bank and is not an official CompTIA statistic.
- Questions analysed
- 90
- Exam domains
- 5
- Hardest domain
- Security Program Management and Oversight (3.1)
- Most approachable domain
- General Security Concepts (2.0)
- Question mix
- 31 single · 31 multi · 28 interactive
- Measured on
- Foundation
Frequently asked questions
What our CompTIA Security+ complexity numbers mean and how they are produced.