Blog Post
Master Security+ PBQ scenarios with this practical guide. Learn how to configure firewalls, analyze logs, and avoid common traps on the SY0-701 exam.
Checking sign-in status...
Most Security+ candidates spend 90% of their prep time on multiple-choice questions and then walk into the exam and immediately hit a performance-based question that stops them cold.
PBQs are not harder because the concepts are different. They're harder because you have to do something rather than recognize something. That's a different skill, and most study plans don't build it deliberately.
This post breaks down the PBQ types that appear most frequently on the SY0-701, what they test, and how to approach each one without wasting time on exam day.
Related: CompTIA Security+ Study Plan ↗
CompTIA uses performance-based questions to verify that you can apply security concepts, not just recall them. The exam typically opens with a small cluster of PBQs before the multiple-choice section begins.
The most common PBQ categories on Security+ are:
Each tests a specific practical skill. Getting comfortable with the format before exam day is not optional if you want a solid score.
These questions present a set of requirements and an interface to configure ACL rules, usually in a drag-and-drop or fill-in format.
Firewall rules are processed top-down, first match wins. A common PBQ mistake is placing a broad allow rule above a specific deny rule, which means the deny never gets evaluated.
Work through rules in this order every time:
A scenario might ask you to allow HTTPS traffic from a specific subnet to a web server while denying all other inbound traffic. The rule set should look something like:
ALLOW TCP 192.168.1.0/24 ANY 443 INBOUND
DENY ANY ANY ANY ANY INBOUND
Order matters, and understanding why each rule exists matters more than syntax.
Related: How Hard Is Security+ ↗
Log analysis questions present raw log output and ask you to identify what happened, classify the event type, or determine the appropriate response.
Don't try to read every line. Scan for anomalies first:
', --, ../ in URLsExample: A log shows 192.168.1.100 - - [10/May/2025:14:23:01] "GET /admin/config.php?user=' OR '1'='1 HTTP/1.1" 500 – that’s a likely SQL injection attempt, not a simple misconfiguration.
Once you identify the pattern, classify it: brute force, reconnaissance, injection attempt, or data exfiltration. Name the attack type before selecting your answer.
These present a topology and ask you to place security controls correctly, identify where a threat entered, or determine which segment is exposed.
Work from the outside in. Start at the internet-facing edge and trace the path inward. Any segment reachable from the internet without a control layer in between is the exposure the question is pointing at.
The only way to get comfortable with PBQs is to practice tasks, not read about them.
That means:
Scenario-based practice that forces you to apply concepts rather than recall them is what closes the PBQ gap. ExamOS includes Security+ Mock Exams built around this kind of applied reasoning, so the decision-making process feels familiar before the exam clock starts.
PBQs exist because CompTIA wants to verify that certified professionals can function in real environments, not just pass a test.
The candidates who handle them well aren't necessarily the ones who studied the most. They're the ones who practiced the right way: working through applied scenarios consistently, building the pattern recognition that makes log analysis fast, and developing the systematic thinking that makes firewall configuration feel routine.
That's a habit, not a sprint. Build it before exam day.
CompTIA does not publish a fixed number of performance-based questions for the SY0-701 exam. Most candidates report encountering between two and five of these questions, which typically appear at the beginning of the test.
Yes, you can flag performance-based questions and return to them later. Many candidates complete the multiple-choice questions first to manage their 90-minute time limit effectively before tackling the performance-based questions.
The passing score is 750 on a scale of 100 to 900. The exam contains a maximum of 90 questions, which includes both multiple-choice and performance-based formats.
You can build your applied reasoning skills using the ExamOS Daily Sprint and Mock Exam features. Once your Readiness Score indicates you are prepared, you can confidently book the real exam.
Preparing for Security+ and want scenario-based practice that covers PBQ-style reasoning alongside standard exam domains? Explore Security+ practice on ExamOS and find out where your applied knowledge holds up under pressure.