Security+ Performance-Based Questions (PBQs), Explained
Performance-based questions are the interactive tasks on the CompTIA Security+ SY0-701 exam that ask you to do something rather than pick a letter. They usually come first and rattle people the most. Here is exactly what they are, the types you will see, two worked examples, and how to handle them on exam day. Free, no account.
Last updated August 2026
The types of PBQ you will see
CompTIA does not publish a fixed list, but SY0-701 PBQs fall into a few recognizable formats. Knowing the format ahead of time means you spend your seconds solving, not figuring out the interface.
- ConfigurationSet values in a simulated tool: write firewall or ACL rules, harden a server, or configure a wireless or account policy to meet a stated requirement.
- Log and output analysisRead logs, packet captures, or command output and identify what happened, such as which host is compromised or which attack the entries show.
- Matching (drag and drop)Map items to categories: attacks to their defenses, controls to their type, or ports to their protocols. Often the fastest PBQs to clear.
- Diagram and topologyPlace devices on a network diagram or pick where a control belongs, such as where to put a firewall, DMZ, or load balancer.
- SequencingPut steps in the right order, most often the incident response phases or a hardening or recovery procedure.
Two worked examples
Example 1: match the attack to the defense
Task: drag each defense to the attack it best mitigates: phishing, SQL injection, on-path (MITM), and brute force.
Approach: work from the attack, not the defense. Phishing → security awareness training. SQL injection → input validation and parameterized queries. On-path → encryption such as TLS. Brute force → account lockout and MFA. If two answers seem to fit, pick the one that targets the attack most directly.
Example 2: read the log
Task: an authentication log shows dozens of failed logins for one account from a single IP in under a minute, then one success. Identify the attack and the best mitigation.
Approach: the pattern, many rapid failures then one success, is a brute-force (or password-spraying) attack. The best mitigation is account lockout after a threshold plus multifactor authentication. Read what the data actually shows before reaching for a familiar-sounding answer; PBQs reward evidence over recognition.
Try a real one, right here
A configuration PBQ in the same style as the exam: four firewall requirements, graded with partial credit, instant feedback on every field. No account needed.
How PBQs are scored, and the exam-day strategy
- Partial credit is common. Many PBQs score per correct action, so a partly correct answer still earns points. Never leave one blank.
- Flag and return. PBQs usually appear first and can eat time. If one looks heavy, mark it, clear the multiple-choice questions, then come back. You can navigate back to it.
- Bank the easy points first. With up to 90 questions in 90 minutes, the multiple-choice items are faster points. Protect your score before sinking ten minutes into one task.
- Practice the doing. You cannot memorize your way through a PBQ. Get hands-on with configs, logs, and matching so the format is muscle memory.
Security+ PBQ FAQ
What is a performance-based question on Security+?
A performance-based question (PBQ) is an interactive task rather than multiple choice. Instead of picking an answer, you complete a job, such as configuring firewall rules, matching attacks to defenses, or reading logs to identify an incident, in a simulated environment.
How many PBQs are on the Security+ exam?
Usually a handful, often around two to five, and they typically appear first. The exam has a maximum of 90 questions in total and the rest are multiple choice. CompTIA does not publish an exact PBQ count, and it varies by exam form.
Are PBQs worth more points than multiple-choice questions?
CompTIA does not disclose exact weighting, but PBQs are generally treated as worth more than a single multiple-choice item because they test applied skill. Either way, do not let one hard PBQ eat all your time.
What is the best way to handle PBQs on exam day?
If a PBQ looks time-consuming, flag it and do the multiple-choice questions first, then come back with your remaining time. You can navigate back to it. Banking the quicker points first protects your score.
Do you get partial credit on Security+ PBQs?
In many cases, yes. PBQs are often scored per correct action, so completing part of the task still earns some points. That is another reason never to leave one completely blank.
How do I practice for Security+ PBQs?
Get hands-on rather than memorizing. Work with real or simulated tools to configure settings, read logs, and match controls to scenarios. SecPlus Mastery includes graded, interactive PBQ-style tasks across the objectives.
Practice real PBQs, not just flashcards
SecPlus Mastery includes graded, interactive PBQ-style tasks across the objectives, plus over 1,000 practice questions, timed mock exams, and spaced review. Get hands-on before exam day instead of seeing your first PBQ on the real thing.
Keep studying: practice test, exam objectives, and how hard the exam is.
Written to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only. SecPlus Mastery is an independent study resource and is not affiliated with or endorsed by CompTIA.