PracticeVideosBlogFlashcardsEspañol
All Practice Exams

100+ Free SEC1 Practice Questions

Prepare for the TryHackMe Cyber Security 101 (SEC1) exam with instant access — no signup required.

✓ No registration✓ No credit card✓ No hidden fees✓ Start practicing immediately
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More TryHackMe Certifications

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

TryHackMe Security Analyst Level 1 (SAL1)

Practice Questions

TryHackMe Junior Penetration Tester (PT1)

Practice Questions

TryHackMe Security Analyst Level 2 (SAL2)

Practice Questions
2026 Statistics

Key Facts: SEC1 Exam

24 hours

Exam Window

TryHackMe

7 sections

Exam Sections

TryHackMe

65%

Passing Score (455/700)

TryHackMe

Beginner

Difficulty Level

TryHackMe

54 rooms

Preparatory Path Length

TryHackMe Cyber Security 101

1 retake

Resit Allowance

TryHackMe

The SEC1 is TryHackMe's entry-level practical certification for learners who complete the 54-room Cyber Security 101 path (~45 hours). The 24-hour exam comprises 7 sections (3 Purple Team, 2 Blue Team, 2 Red Team) with fill-in-the-blank questions answered using real tools in a browser-based VM. Passing score is 455/700 (65%). One retake is available after a cooldown period. The exam is included with a TryHackMe Premium subscription. This practice bank tests the foundational knowledge — Linux/Windows CLI, Nmap, Metasploit, Wireshark, Hydra, Gobuster, CyberChef, SQLi, XSS, log analysis, and incident response — required to succeed in the hands-on sections.

Sample SEC1 Practice Questions

Try these sample questions to test your SEC1 exam readiness. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1In the CIA triad, which property ensures that information is accessible only to those with authorized access?
A.Availability
B.Confidentiality
C.Integrity
D.Authenticity
Explanation: Confidentiality ensures that sensitive information is accessible only to authorized parties. It is enforced through mechanisms such as encryption, access controls, and authentication. Integrity ensures data has not been altered, while availability ensures systems remain accessible to authorized users.
2Which of the following best describes the role of a Security Operations Center (SOC)?
A.Monitoring, detecting, and responding to security incidents 24/7
B.Developing new security software and tools
C.Conducting penetration tests against external targets
D.Managing an organization's firewall rule configurations
Explanation: A SOC is a centralized team that continuously monitors an organization's security posture, detects threats using SIEM and other tools, and coordinates incident response. It operates around the clock to reduce mean time to detect (MTTD) and mean time to respond (MTTR) to threats.
3What is the primary purpose of the Nmap tool in the context of offensive security?
A.Password hash cracking
B.Web application fuzzing
C.Network scanning and host discovery
D.Malware sandboxing
Explanation: Nmap (Network Mapper) is used to discover hosts on a network, determine open ports, identify running services and versions, and fingerprint operating systems. It is a foundational reconnaissance tool in penetration testing and CTF challenges, and is covered in the THM Cyber Security 101 path.
4Which Nmap flag performs a SYN (stealth) scan, sending SYN packets without completing the TCP handshake?
A.-sT
B.-sU
C.-sS
D.-sV
Explanation: The -sS flag performs a TCP SYN scan, also called a half-open or stealth scan. Nmap sends SYN packets and observes whether a SYN-ACK or RST is returned without completing the three-way handshake, making it less likely to appear in application logs. It requires root/administrator privileges.
5In the Linux filesystem, which directory stores system-wide configuration files?
A./bin
B./var
C./etc
D./home
Explanation: /etc contains system-wide configuration files and shell scripts for system initialization. Examples include /etc/passwd (user accounts), /etc/shadow (password hashes), /etc/hosts (local DNS mappings), and /etc/crontab (scheduled tasks). This knowledge is essential for Linux privilege escalation enumeration.
6Which Linux command displays the current user's group memberships?
A.whoami
B.ps aux
C.uname -a
D.id
Explanation: The `id` command displays the current user's UID, GID, and all supplementary group memberships. This is important during privilege escalation enumeration — if a user is in the `sudo` or `docker` group, it may allow privilege escalation to root.
7In Windows, which Event ID is generated when a user successfully logs on interactively?
A.4624
B.4625
C.4688
D.4720
Explanation: Windows Event ID 4624 is logged in the Security event log whenever an account successfully logs on. The logon type field indicates how the logon occurred: Type 2 = interactive, Type 3 = network, Type 10 = remote interactive (RDP). Blue teams analyze 4624 logs for lateral movement and unauthorized access.
8What does the Metasploit module type 'exploit' do?
A.Delivers a payload to exploit a vulnerability and gain access
B.Scans targets for open ports
C.Generates shellcode for manual injection
D.Performs passive traffic sniffing
Explanation: In Metasploit Framework, 'exploit' modules leverage known vulnerabilities to gain unauthorized access to a target system. They work in conjunction with 'payload' modules (such as reverse shells or Meterpreter) that execute after the exploit succeeds. The exploit module handles the vulnerability, while the payload handles post-exploitation communication.
9Which protocol does HTTPS use to encrypt web traffic, replacing the deprecated SSL?
A.SSH
B.TLS
C.IPsec
D.SFTP
Explanation: HTTPS uses Transport Layer Security (TLS) to encrypt web communication between clients and servers. TLS replaced the older, insecure SSL protocol. Current best practice is TLS 1.2 or TLS 1.3 — older versions (SSL 3.0, TLS 1.0, TLS 1.1) are deprecated due to known vulnerabilities like POODLE and BEAST.
10In the OSI model, at which layer does the TCP protocol operate?
A.Layer 2 — Data Link
B.Layer 3 — Network
C.Layer 4 — Transport
D.Layer 7 — Application
Explanation: TCP (Transmission Control Protocol) operates at Layer 4, the Transport layer of the OSI model. It provides reliable, connection-oriented communication through the three-way handshake (SYN, SYN-ACK, ACK), error detection, and retransmission. Understanding OSI layers is fundamental for analyzing network protocols and traffic.

About the SEC1 Exam

The TryHackMe Cyber Security 101 (SEC1) certification is a beginner-level, 100% practical exam designed for learners who complete the Cyber Security 101 learning path. The 24-hour exam presents 7 real-world sections spanning Red Team, Blue Team, and Purple Team scenarios using an analyst VM with actual artifacts. This practice bank tests the foundational knowledge needed to navigate those hands-on challenges.

Assessment

Performance-based assessment

Time Limit

24 hours (7 sections: 3× 45-min + 4× 60-min timers)

Passing Score

455/700 (65%)

Exam Fee

Included with TryHackMe Premium (TryHackMe)

SEC1 Exam Content Outline

21%

Purple Team — OS & Shell Fundamentals

Linux and Windows command-line proficiency, PowerShell scripting, Bash shells, packet capture analysis, and OS security features

15%

Networking & Secure Protocols

OSI model, TCP/IP, DNS, HTTP/HTTPS, TLS, Wireshark basics, tcpdump, Nmap scanning, and foundational network analysis

15%

Cryptography Basics

Symmetric and asymmetric encryption, hashing (MD5, SHA-256), public-key cryptography, digital signatures, password cracking with John the Ripper

17%

Offensive Security & Tooling

Exploitation basics (Metasploit, EternalBlue/Blue room), Hydra brute-forcing, Gobuster directory enumeration, SQLMap, reverse and bind shells, OSINT with theHarvester and WHOIS

17%

Web Application Security

SQL injection, XSS (stored/reflected/DOM), IDOR, command injection, Burp Suite basics, OWASP Top 10 fundamentals, JavaScript security

15%

Defensive Security & SOC

SOC fundamentals, SIEM concepts, digital forensics (hashing, chain of custody), incident response (NIST SP 800-61), log analysis, Windows event IDs, phishing analysis (SPF/DKIM/DMARC)

How to Pass the SEC1 Exam

What You Need to Know

  • Passing score: 455/700 (65%)
  • Assessment: Performance-based assessment
  • Time limit: 24 hours (7 sections: 3× 45-min + 4× 60-min timers)
  • Exam fee: Included with TryHackMe Premium

Keys to Passing

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

SEC1 Study Tips from Top Performers

1Complete all 54 rooms in the Cyber Security 101 path before attempting the exam — practical hands-on experience is essential
2Master Linux and Windows CLI — the Purple Team sections require command-line proficiency with bash and PowerShell
3Practice Wireshark display filters: http.request.method=="GET", ip.addr==, tcp.flags.syn==1, and Follow TCP Stream
4Learn Nmap flags: -sS (SYN scan), -sV (version detection), -sC (default scripts), -oX (XML output), -p- (all ports)
5Understand the NIST SP 800-61 four IR phases: Preparation → Detection & Analysis → Containment/Eradication/Recovery → Post-Incident
6Learn key Windows Event IDs: 4624 (logon success), 4625 (logon fail), 4688 (process creation), 4698 (scheduled task), 1102 (log cleared)
7Practice SQLi payloads: ' OR '1'='1, UNION SELECT, and understand the difference between error-based, union-based, and blind SQLi
8Use CyberChef to decode base64, hex, and PowerShell -EncodedCommand payloads (From Base64 → Decode UTF-16LE)
9Understand MITRE ATT&CK tactics, Pyramid of Pain IOC hierarchy, and the Cyber Kill Chain 7-stage model
10Complete all 100 practice questions here to build conceptual understanding before transitioning to hands-on lab work

Frequently Asked Questions

What is the TryHackMe SEC1 exam format?

The SEC1 is a 24-hour practical exam divided into 7 sections: 3 Purple Team sections (45 minutes each) and 4 Red/Blue Team sections (60 minutes each). Each section has 10 fill-in-the-blank questions. Candidates use a browser-based analyst VM with real tools and artifacts. Total possible score is 700 points; 455 (65%) is required to pass.

What topics are covered in the SEC1 exam?

The SEC1 covers six core areas: (1) OS fundamentals — Windows and Linux architecture, CLI proficiency, filesystem, user management; (2) Network traffic analysis — protocol analysis, Wireshark, packet capture; (3) Web application security — common vulnerabilities, basic penetration testing; (4) Security operations — log analysis, threat detection, SOC workflows; (5) Password attacks and credential security — brute-forcing, dictionary attacks, cracking; (6) Malware analysis fundamentals — identifying malware types, basic static and dynamic analysis.

How should I prepare for the SEC1 exam?

Complete all 54 rooms in the TryHackMe Cyber Security 101 learning path, which covers 13 modules including Linux/Windows fundamentals, networking, cryptography, web hacking, Metasploit, and defensive security tooling. Practice using all tools hands-on: Nmap, Hydra, Gobuster, Burp Suite, Wireshark, CyberChef, and CAPA. Use these 100 practice questions to reinforce conceptual knowledge before the practical exam.

Is the SEC1 exam multiple choice?

No — the SEC1 is 100% practical and hands-on with fill-in-the-blank answers derived from real tool usage. There are no multiple-choice questions on the actual exam. This practice bank provides MCQ-format questions to build the underlying knowledge needed to navigate the practical sections effectively.

What tools are used in the SEC1 exam?

The SEC1 uses real cybersecurity tools in a browser-based VM. Based on the exam sections, expect to use: Linux CLI (bash, grep, find, ss), PowerShell, Wireshark for packet analysis, web application testing tools (Burp Suite, Gobuster), brute-force tools (Hydra), and blue team investigation tools. The Cyber Security 101 learning path covers all required tools.

What jobs can I get with the SEC1 certification?

The SEC1 is an entry-level certification demonstrating foundational red, blue, and purple team knowledge. It supports junior roles such as: SOC Analyst Tier 1 ($45,000-65,000), IT Security Analyst ($50,000-70,000), Cybersecurity Technician ($45,000-65,000), and Junior Penetration Tester ($55,000-75,000). It is a strong stepping stone to more advanced certifications like BTL1, Security+, or eJPT.