Performance-Based Questions (PBQs) Strategy

Performance-Based Questions (PBQs) are interactive simulation questions that require you to demonstrate practical skills in a virtual environment, rather than simply selecting the best answer from four text choices. CompTIA introduced PBQs to address the gap between knowing facts and being able to apply them — a technician who truly understands firewall rules should be able to configure one, not just describe what they do. PBQs count toward your score just like multiple-choice questions and are worth the same points. They appear at the beginning of the SY0-701 exam and typically consume more time than multiple-choice questions.

The Security+ exam features several distinct PBQ formats: Firewall rule configuration — given a network diagram and requirements, add ACL rules to allow/deny specific traffic; Network diagram labeling — place firewall, IDS, DMZ, and other components in the correct locations in a network diagram; Log analysis — examine provided log excerpts (syslog, Windows event log, web access log) and identify attack types or answer specific questions; Drag-and-drop ordering — arrange incident response phases, forensic steps, or PKI components in correct sequence; and Matching — connect attack types to descriptions or tools to their functions.

A critical time management strategy: do not get stuck on PBQs at the start of the exam. PBQs are presented first, and they can take 5-10 minutes each if you are uncertain. The recommended approach is to flag each PBQ and skip it immediately, then complete all multiple-choice questions first. You typically have more confidence on multiple-choice questions, and answering them may even jog your memory for PBQ details. Return to PBQs when you have completed all multiple-choice questions. With 90 minutes for up to 90 questions, averaging 1 minute per question, this leaves adequate time to revisit PBQs.

Firewall PBQs typically provide a network diagram with multiple zones (internet, DMZ, internal LAN) and a requirements list: 'Allow HTTP/HTTPS from internet to web server in DMZ; deny direct internet access to internal servers; allow DNS queries from internal to external'. You must add rules in the correct order (firewall rules are processed top-to-bottom, first-match-wins). Key knowledge: implicit deny at the bottom of all rule sets; stateful inspection allowing return traffic automatically; common ports (80=HTTP, 443=HTTPS, 22=SSH, 25=SMTP, 53=DNS, 3389=RDP). Practice reading source/destination/port/action rule tables.

Log analysis PBQs provide excerpts from various log sources and ask you to identify what occurred. For web server logs: look for SQL injection patterns (' OR '1'='1, UNION SELECT), XSS (<script> in query strings), or directory traversal (../../../etc/passwd). For Windows event logs: Event ID 4625 = failed login, 4740 = account lockout, 4624 = successful login, 4672 = special privileges — multiple 4625s followed by a 4624 indicates a brute force success. For network captures: look for SYN floods (many SYN without SYN-ACK response), port scans (sequential port numbers from one IP), and ICMP floods.

Network diagram PBQs test your understanding of security zone architecture. Key concepts for correct component placement: DMZ (Demilitarized Zone) sits between two firewalls (internet-facing and internal) and hosts publicly accessible servers (web, email, DNS); the internet-facing firewall sits at the perimeter, directly connected to the ISP link; IDS/IPS sensors are placed on network segments where they can see traffic (IDS passively mirrors, IPS is inline); proxy servers sit between internal users and the internet; and SIEM collects logs from all components. Avoid placing internal databases in the DMZ — they belong in the trusted internal zone.

Drag-and-drop PBQs test knowledge of ordered processes and concept mapping. Master these orderings: Incident Response phases — Preparation, Detection and Analysis, Containment, Eradication, Recovery, Post-Incident Review (NIST SP 800-61); Penetration Test phases — Reconnaissance, Scanning/Enumeration, Exploitation, Post-Exploitation/Lateral Movement, Reporting; Forensic evidence order of volatility — CPU registers/cache, RAM, swap/page file, running processes, network connections, disk image, remote logs (most volatile first); Risk management steps — Identify, Assess, Respond/Treat, Monitor. These orders are frequently tested in drag-and-drop format.

CompTIA Security+ PBQs award partial credit — you do not need to complete every component of a PBQ perfectly to earn points. This means: even if you are unsure about one aspect of a firewall configuration, complete the parts you know correctly and guess on the uncertain parts rather than leaving them blank. Do not skip or leave PBQs entirely unanswered — incomplete PBQs receive fewer or no points while a partially correct attempt earns partial credit. If a PBQ asks you to configure 5 firewall rules and you correctly configure 3, you receive approximately 60% of the available points for that question.

PBQ practice requires hands-on simulation that text-based study does not provide. Resources for PBQ preparation: CompTIA CertMaster Practice — the official practice platform with realistic PBQ simulations; Jason Dion's Udemy course — includes realistic lab simulations and PBQ walkthroughs; Professor Messer's PBQ practice labs — affordable PDF-based walkthroughs; Dion Training free PBQs — free browser-based firewall and network diagram PBQ simulators; and home lab practice using pfSense (free open-source firewall) to practice rule configuration hands-on. The single most effective preparation for PBQs is doing practice PBQs repeatedly until the interface and task types feel familiar.

When you encounter a PBQ where you are uncertain: use the process of elimination — even in simulations, some answers are clearly wrong; apply core principles — least privilege, defense in depth, and implicit deny apply universally and guide correct answers even when you do not know the specific rule; read the scenario carefully — PBQ scenarios include all the information needed to answer correctly, and overlooking details in the scenario is the most common PBQ mistake; do not overthink — PBQs test practical knowledge, not obscure edge cases. The correct answer usually follows the most obvious application of the security principle described in the scenario.

With 90 minutes and up to 90 questions, time allocation is critical. A recommended strategy: Pass 1 (0-45 min) — answer all multiple-choice questions you know confidently (skip uncertain ones); Pass 2 (45-70 min) — return to flagged multiple-choice questions, apply elimination; Pass 3 (70-85 min) — attempt all PBQs with remaining time; Final 5 minutes — ensure no questions are unanswered (there is no penalty for wrong answers on CompTIA exams, so always answer every question). Practice exams with a strict timer build the time awareness needed to stay on pace during the real exam.

Test your understanding of CompTIA Security+ (SY0-701) concepts from this lesson.

In this lesson you learned: PBQs test hands-on skills including firewall rule configuration, network diagram analysis, log interpretation, and ordered process knowledge — they appear first but should be skipped initially, partial credit is awarded on PBQs so always attempt them with remaining time rather than leaving them blank, and regular practice with PBQ simulators is the most effective preparation since familiarity with the simulation interface reduces anxiety and improves performance on exam day. Next up we review the high-frequency topics that most commonly appear on the Security+ exam.