How we write and verify questions
Most practice sites tell you their questions are “expert-written” and leave it there. Here is exactly what we do instead, including the numbers, updated every time we deploy.
Where the bank stands right now
All 10,115 questions you can practise right now are original and source-cited. 10,075 of them have additionally passed documentation verification and say so in a caption under their explanation; the rest cite their source but have not yet cleared that check, and show no caption. Anything whose cited source we found to contradict it, or whose citation did not hold up, is blocked and never served. We would rather show you fewer questions we can stand behind than a big number we cannot.
The verification programme
The most recent check ran on 4 September 2026, and the first on record ran on 23 July 2026. 10,225 records come from the automated documentation check described below; 40 were cleared individually instead, which is what the two numbers in the block above are counting. Every one of these is read from the records at build time, so this page is as current as the last deploy and no more.
1Written from published objectives, never from exam content
Every question is original. We write each one from the exam objectives the certifying body publishes openly: CompTIA’s objectives documents, Microsoft Learn skills outlines, AWS exam guides, Cisco blueprints. We do not possess, reproduce, or paraphrase real exam content, and we do not buy question sets from anyone. Using leaked exam content can get your certification revoked, and it cannot prepare you for the performance-based items that decide real exams.
2Checked against a ten-point rubric
Before a question is even a candidate, it has to pass ten checks. These catch the failures that make practice questions worthless: an answer you can guess from its length, a distractor nobody would pick, an explanation that restates the question.
- 1Maps to exactly one published sub-objective
- 2Original; never derived from a real exam item
- 3Scenario-based where it should be (bank target: 60%+ scenario)
- 4Exactly one defensible answer (or exact multi set)
- 5Every distractor plausible to a partially prepared candidate
- 6No clueing via length, grammar, or specificity
- 7Three-tier explanation complete and substantive
- 8Doc link is a real, current, authoritative page
- 9Difficulty rated 1-3 (bank target 25/50/25)
- 10Current exam version content; zero retired material
3Verified against the vendor's own documentation
This is the part nobody else does, and it is the whole point. A question passing an internal rubric can still be confidently wrong. So every question is checked against an external authoritative source, its cited documentation, and assigned one of four states:
Doc verified
The cited source supports the answer unambiguously and contradicts no distractor. These say so in a caption under the explanation, naming the checked page and the month of the check.
Needs review
The source was ambiguous, partly disagreed, or no adequate source was found. The question serves only after a person approves it, stays source-cited, and gets no verification caption until it clears.
Unsourced
The cited link is dead: the page came back 400, 404 or 410, so the evidence cannot be checked at all. Blocked: never served, under any circumstances. A page that is live but blocked to our fetcher goes to review instead, because unreachable is not the same as gone.
Contradicted
The cited source actually disagrees with the marked answer. The highest-priority defect, and never served.
The rule is strict on purpose: contradicted and unsourced questions can never reach you. When we mark a question doc-verified, we store the passage the judgement rests on, alongside the link, so the decision can be audited rather than trusted. Most of those passages are quoted from the page word for word. Some are a close summary of the sentences that settle the answer, which is why we store the link next to the text: the page is the evidence, and you can open it.
The receipts
Here is how those states fall across the 10,115 questions serving right now, counted at every deploy from the same records that gate serving:
- 10,075verified against their cited page, with the passage that supports the answer stored and the check dated
- 40source-cited and individually cleared to serve, one question at a time, rather than by the automatic documentation check
- 0written, then blocked by verification: contradicted by their source or citing a dead page. Never served
When a question is marked doc verified, three concrete things happened: the cited page was fetched again at check time, the passage that supports the marked answer was stored with the record, and the check was dated. The caption you see under a verified question’s explanation renders straight from that record, and its link opens the same page, so you can read what we read.
The check itself is AI-assisted documentation review: software re-fetches the cited source and a model judges whether the passage supports the marked answer, keeping the passage on file so the judgement can be audited. It is not human review of every question, and we will not dress it up as that. What it proves is narrow and useful: the marked answer agrees with a live official page. Where the check does not confirm the answer, the question does not serve on the strength of the check. Its cited page is read again, and it serves only if that reading finds the passage the answer rests on. If it does not, the question is held back or blocked outright.
4Every question is source-cited
Every question links to the exact vendor documentation it was written from, and you can open that source from the question itself. The citation is not decoration: it is what verification checks. Either the source is confirmed to support the answer, and the question carries its verification caption, or it is not, and the question is held without the caption or blocked outright if the source disagrees. We would rather show you a source you can check for yourself than ask you to take our word that a question is right. We make no claim that a person has read every question line by line: that would not be true at this volume, and it is not what decides whether a question serves.
5If you find a mistake, tell us
The report link sits on every question. It captures the question, the answer you chose, and your comment, and it goes to the top of the review queue, because a real candidate who thinks a question is wrong is the best signal we get. Or email issues@firsttry.app. We would rather retire a question than keep a wrong one.
Verified questions by certification
Where documentation verification has reached, so far. Every bar is read against the deepest bank in the product, not against its own vendor, so the shape of the table is the shape of the work.
- Microsoft Azure FundamentalsAZ-900295
- Microsoft Azure AdministratorAZ-104260
- Microsoft Azure AI FundamentalsAI-90188
- Microsoft DevOps Engineer ExpertAZ-40080
- AWS Certified Security SpecialtySCS-C03171
- AWS Certified AI PractitionerAIF-C01152
- AWS Certified Data Engineer - AssociateDEA-C01138
- AWS Certified Cloud PractitionerCLF-C02134
- AWS Certified Developer - AssociateDVA-C02130
- CompTIA Security+SY0-701307
- CompTIA PenTest+PT0-003208
- CompTIA Network+N10-009206
- CompTIA Linux+XK0-005205
- CompTIA CySA+CS0-003198
- CompTIA A+ Core 1220-1201185
- CompTIA A+ Core 2220-1202184
- Cisco CCNA200-301206
- Cisco CCNP Enterprise (ENCOR core)350-401120
- Cisco CCNP Security (SCOR core)350-701120
- ISC2 CISSPCISSP228
- GIAC Security EssentialsGSEC207
- Associate Cloud EngineerACE100
- Cloud Digital LeaderCDL100
- Splunk Enterprise Certified ArchitectEnterprise Certified Architect190
- Splunk Core Certified Advanced Power UserCore Certified Advanced Power User162
- Splunk Certified Cybersecurity Defense ArchitectCybersecurity Defense Architect142
- Splunk Core Certified Power UserCore Certified Power User140
- Splunk Certified Cybersecurity Defense AnalystCybersecurity Defense Analyst138
- Splunk Cloud Certified AdminCloud Certified Admin133
- Splunk Enterprise Certified AdminEnterprise Certified Admin129
- Splunk Core Certified UserCore Certified User128
- Splunk Certified Cybersecurity Defense EngineerCybersecurity Defense Engineer125
- Splunk O11y Cloud Certified Metrics UserO11y Cloud Certified Metrics User116
Documentation verification currently covers 100% of everything written. The rest is real work in progress, not a number we are hiding.