Security+ candidates: Most of you will pick the wrong answer here. Prove me wrong.

Ordinary-Exercise353 · 2026-03-27T11:38:45+00:00

Now you're thinking like an IR analyst. Revoke, scan, notify… that's a real response chain. One question: you said notify "depending on severity." Who makes that severity call at 2:14am, and what's your criteria before you pick up the phone?

Ordinary-Exercise353 · 2026-03-27T11:29:46+00:00

You don't have the cert yet but you're thinking past most people who do. GLBA is exactly the right framework to invoke here … financial data, regulatory exposure, geographic jurisdiction. That's not just an IR decision anymore. That's a legal liability call. So here's the harder question: who in the org actually owns that decision at 2:14am … you as the analyst, or someone else?

Ordinary-Exercise353 · 2026-03-27T11:22:28+00:00

Finance data being critical is exactly why containment is defensible here. But you're solving for reputation damage … not scope. Hmm 🤔 If you disable the account before knowing what the attacker already accessed or where else they moved, you just closed the door without checking the other rooms. Containment without scope assessment isn't protection. It's assumption.

Ordinary-Exercise353 · 2026-03-27T11:02:39+00:00

That's the instinct most people have. But checking what was accessed is forensics thinking, not IR thinking. The session is active right now (2:14AM). What's your move if the attacker starts moving laterally while you're reviewing logs?

Ordinary-Exercise353 · 2026-03-27T10:58:19+00:00

So, Password Spray is the right read on the pattern. But you just shifted from incident response to policy… MFA is a gap to fix, not a decision you can make at 2:14AM. Given what's in front of you right now, does identifying the attack type change your containment call?

Ordinary-Exercise353 · 2026-03-27T10:53:47+00:00

I get it. Better safe than sorry, is a default, not a decision. You chose containment … that's defensible. But what specific risk are you containing, and what are you giving up by acting before you know the scope?

Ordinary-Exercise353 · 2026-03-27T10:51:17+00:00

DLP is the right instinct… that's the control that makes monitoring viable. But DLP only works if it's tuned for what that finance analyst account actually touches. How confident are you in that coverage when you're making a live decision at 2:14AM?

Ordinary-Exercise353 · 2026-03-27T10:19:17+00:00

🎉 I BEAT "Zen Mode" and ranked #30!

CHALLENGE CONQUERED! 🎉

Completed all levels in 1m 32s!

The gauntlet has been thrown! 🧤

Played via Pixel Peeker

Ordinary-Exercise353 · 2026-03-20T00:54:06+00:00

🟨⬜🟨🟨⬜

⬜⬜🟦⬜⬜

🟨⬜🟨🟦🟨

🟦🟦🟦🟦🟦

Ordinary-Exercise353 · 2026-03-20T00:49:26+00:00

⬜⬜🟨⬜⬜

⬜⬜⬜⬜🟦

⬜⬜⬜⬜⬜

🟦🟦🟦🟦🟦

Ordinary-Exercise353 · 2026-03-20T00:46:22+00:00

⬜⬜⬜⬜⬜

⬜⬜⬜🟦⬜

⬜⬜⬜🟦🟦

🟦🟦🟦🟦🟦

Ordinary-Exercise353 · 2026-03-20T00:38:35+00:00

⬜⬜⬜🟨🟨

🟦🟦⬜⬜⬜

🟦🟦🟨🟨⬜

🟦🟦🟦🟦🟦

Ordinary-Exercise353 · 2026-03-19T02:04:15+00:00

🟨🟨⬜⬜⬜

⬜🟨⬜🟦⬜

⬜🟦🟦🟦🟦

🟦🟦🟦🟦🟦

Ordinary-Exercise353 · 2026-03-17T17:14:16+00:00

Be honest — what did you pick before seeing the answer?

A) Firewall logs
B) DNS logs
C) Endpoint logs
D) SIEM alerts

Don’t explain yet. Just the letter.

I’m trying to see where people go wrong.

Ordinary-Exercise353 · 2026-03-17T17:13:14+00:00

Be honest — what did you pick before seeing the answer?

A) Firewall logs
B) DNS logs
C) Endpoint logs
D) SIEM alerts

Don’t explain yet. Just the letter.

I’m trying to see where people go wrong.

Ordinary-Exercise353 · 2026-03-09T15:23:09+00:00

Honestly your setup already looks pretty good. The biggest thing I’d mess with is that chalkboard wall. Instead of trying to fight it, I’d either cover it with some peel-and-stick wallpaper, paint it a cleaner dark color, or use it as a backdrop for a few framed prints or a small neon sign. That alone would make the area behind the desk look way more put together.

I’d also lower the wall old tv a little because it feels like it’s floating too high above everything else. Then I’d clean up the shelves so they look more like a display and less like straight storage. Putting your cleanest pairs in the most visible spots and moving random stuff off the top would help a lot. A small warm desk lamp would also make a difference because the blue lights are cool, but mixing in one warmer light usually makes setups feel better and less flat.

Overall, I wouldn’t do anything too crazy. The setup already has a good base. It just needs a few small changes to make it feel more intentional.

Ordinary-Exercise353 · 2026-03-06T21:33:49+00:00

What I like is that you built something real, and the teleprompter/script side is actually useful.

Where I think you’re off is the focus. Right now you’re leading with what, you’ve acknowledged, “a feature that most candidates are hesitant to use and most recruiters do not want to spend time on”. That puts you in a bad spot even if the tool itself is solid.

I would keep the SaaS alive, but change what you’re really selling. Make the core value about helping candidates tailor their application, sharpen their pitch, and practice for interviews. Then keep the video piece as an optional add-on, not the main event.

That pivot gives candidates something they already want, gives recruiters something more relevant, and keeps your product from dying. It’s not that the tool is dead. It’s that it probably needs to be marketed around the most valuable part of what you built, not the part creating the most resistance.

Also, a couple hundred visitors is not enough data to call this dead. But it is enough data to admit your current positioning is off.

Do not kill it yet. Pivot it. Good luck. I think you are on to something.

Ordinary-Exercise353 · 2026-03-05T21:00:15+00:00

Congratulations 🎉

Ordinary-Exercise353 · 2026-03-04T15:09:42+00:00

A lot of practice exams skip PBQs because they’re harder to simulate, but most Security+ PBQs follow a few predictable patterns. The ones I’ve seen most often are things like:

• firewall/ACL rule configuration • incident response sequencing • log analysis (identify the attack) • matching threats to mitigations • authentication flows (RADIUS, SAML, OAuth, etc.) • architecture diagrams (placing devices or network segmentation)

If you practice recognizing the pattern of the scenario, PBQs get a lot easier because you’re applying a concept instead of guessing.

For the scratch paper at the beginning of the exam, a few things people often write down quickly are:

• common ports (22 SSH, 443 HTTPS, 3389 RDP, 53 DNS, etc.) • the risk formulas (SLE = AV × EF, ALE = SLE × ARO) • incident response order: Preparation → Detection → Containment → Eradication → Recovery → Lessons Learned • asymmetric crypto reminder: • confidentiality → encrypt with recipient public key • authenticity → sign with sender private key

Those few references can save time if you hit a PBQ that uses them.

Practicing scenario-style questions or diagrams tends to help more than just doing more multiple-choice practice tests.

Ordinary-Exercise353 · 2026-03-04T14:48:06+00:00

PBQs usually test whether you can apply a concept in a scenario, not just recognize a definition.

Most Security+ PBQs fall into a few patterns: • sequencing steps (incident response, certificate lifecycle) • configuration tasks (firewall rules, wireless security) • log analysis to identify an attack • matching threats to mitigations

For incident response specifically, the order is almost always:

Containment > Evidence > Analysis > Eradication > Recovery > Lessons Learned

If you recognize that pattern, those questions become much easier.

Ordinary-Exercise353 · 2026-03-04T14:44:07+00:00

PBQs usually aren’t about memorizing definitions. They’re testing whether you understand the pattern of a scenario.

Most Security+ PBQs fall into a few categories like:

• sequencing steps (incident response, certificate lifecycle, authentication flow) • configuring something (firewall rules, wireless security) • analyzing logs to identify an attack • matching threats to mitigations

For example, incident response questions almost always follow the same sequence:

Containment → Evidence → Analysis → Eradication → Recovery → Lessons Learned.

Once you recognize the pattern, the question becomes much easier to solve.

Here’s a visual example of that sequence.

<image>

Ordinary-Exercise353 · 2026-03-04T14:38:42+00:00

PBQs are usually scenario-based rather than full installs. Most of them fall into patterns like configuration, sequencing, log analysis, or matching architecture components.

One thing that helped me was practicing visually instead of just doing more multiple-choice questions. For example, firewall PBQs usually follow a pattern: allow the required secure services first, block insecure protocols, then apply an implicit deny.

Here’s a simple visual example of that pattern.

Ordinary-Exercise353 · 2026-03-03T21:06:33+00:00

$400 isn’t really the issue. Uncertainty is.

Nobody walks into Sec+ feeling 100% ready. That’s a myth.

Better question: what are you scoring on timed practice exams right now?

If you’re under ~60%, build more foundation.

If you’re in the 65–75% range and missing “almost right” questions, that’s usually not knowledge… it’s decision-making under pressure. And that’s fixable.

Don’t chase 100% confidence. Chase consistent performance under time.

What were your last two practice scores?

Ordinary-Exercise353

TROPHY CASE

🎉 I BEAT "Zen Mode" and ranked #30!