Loading page
Performance-based questions are the interactive tasks on the CompTIA Security+ SY0-701 exam that ask you to do something rather than pick a letter. They usually come first and rattle people the most. Here is exactly what they are, the types you will see, two worked examples, and how to handle them on exam day. Free, no account.
Last updated July 2026
CompTIA does not publish a fixed list, but SY0-701 PBQs fall into a few recognizable formats. Knowing the format ahead of time means you spend your seconds solving, not figuring out the interface.
Task: drag each defense to the attack it best mitigates: phishing, SQL injection, on-path (MITM), and brute force.
Approach: work from the attack, not the defense. Phishing → security awareness training. SQL injection → input validation and parameterized queries. On-path → encryption such as TLS. Brute force → account lockout and MFA. If two answers seem to fit, pick the one that targets the attack most directly.
Task: an authentication log shows dozens of failed logins for one account from a single IP in under a minute, then one success. Identify the attack and the best mitigation.
Approach: the pattern, many rapid failures then one success, is a brute-force (or password-spraying) attack. The best mitigation is account lockout after a threshold plus multifactor authentication. Read what the data actually shows before reaching for a familiar-sounding answer; PBQs reward evidence over recognition.
A configuration PBQ in the same style as the exam: four firewall requirements, graded with partial credit, instant feedback on every field. No account needed.
A performance-based question (PBQ) is an interactive task rather than multiple choice. Instead of picking an answer, you complete a job, such as configuring firewall rules, matching attacks to defenses, or reading logs to identify an incident, in a simulated environment.
Usually a handful, often around two to five, and they typically appear first. The exam has a maximum of 90 questions in total and the rest are multiple choice. CompTIA does not publish an exact PBQ count, and it varies by exam form.
CompTIA does not disclose exact weighting, but PBQs are generally treated as worth more than a single multiple-choice item because they test applied skill. Either way, do not let one hard PBQ eat all your time.
If a PBQ looks time-consuming, flag it and do the multiple-choice questions first, then come back with your remaining time. You can navigate back to it. Banking the quicker points first protects your score.
In many cases, yes. PBQs are often scored per correct action, so completing part of the task still earns some points. That is another reason never to leave one completely blank.
Get hands-on rather than memorizing. Work with real or simulated tools to configure settings, read logs, and match controls to scenarios. SecPlus Mastery includes graded, interactive PBQ-style tasks across the objectives.
SecPlus Mastery includes graded, interactive PBQ-style tasks across the objectives, plus over 1,000 practice questions, timed mock exams, and spaced review. Get hands-on before exam day instead of seeing your first PBQ on the real thing.
Keep studying: practice test, exam objectives, and how hard the exam is.
Written to the CompTIA Security+ SY0-701 objectives. CompTIA and Security+ are trademarks of CompTIA, used here for identification only. SecPlus Mastery is an independent study resource and is not affiliated with or endorsed by CompTIA.