Blog Post
Security+ PBQ Deep Dive: Firewall Configuration, Log Analysis and More
Performance-based questions (PBQ) are where most Security+ candidates lose points. Here's a practical breakdown of firewall configuration, log analysis, and other PBQ scenarios you need to master.
Security+ PBQ Deep Dive: Firewall Configuration, Log Analysis and More
Most Security+ candidates spend 90% of their prep time on multiple-choice questions and then walk into the exam and immediately hit a performance-based question that stops them cold.
PBQs are not harder because the concepts are different. They're harder because you have to do something rather than recognize something. That's a different skill, and most study plans don't build it deliberately.
This post breaks down the PBQ types that appear most frequently on the SY0-701, what they're actually testing, and how to approach each one without wasting time on exam day.
👉Learn more about CompTIA Security+
What PBQs Are Actually Testing
CompTIA uses performance-based questions to verify that you can apply security concepts, not just recall them. The exam typically opens with a small cluster of PBQs before the multiple-choice section begins.
The most common PBQ categories on Security+ are:
- Firewall rule configuration
- Log analysis and event correlation
- Network diagram interpretation
- Wireless security configuration
- Vulnerability scan output analysis
- Cryptography matching and ordering
Each tests a specific practical skill. Getting comfortable with the format before exam day is not optional if you want a solid score.
👉Know how hard is CompTIA Security+
Firewall Configuration PBQs
These questions present a set of requirements and an interface to configure ACL rules, usually in a drag-and-drop or fill-in format.
What Gets Tested
- Rule ordering and the implicit deny at the end
- Source/destination IP and port specification
- The difference between inbound and outbound rule direction
- When to allow vs. deny specific traffic flows
The Trap Most Candidates Fall Into
Firewall rules are processed top-down, first match wins. A common PBQ mistake is placing a broad allow rule above a specific deny rule, which means the deny never gets evaluated.
Work through rules in this order every time:
- Identify what must be explicitly denied first
- Place specific rules before general ones
- Confirm the implicit deny-all exists at the bottom
- Verify rule direction matches the traffic flow described
A scenario might ask you to allow HTTPS traffic from a specific subnet to a web server while denying all other inbound traffic. The rule set should look something like:
ALLOW TCP 192.168.1.0/24 ANY 443 INBOUND
DENY ANY ANY ANY ANY INBOUND
Order matters – and understanding why each rule exists matters more than syntax.
Log Analysis PBQs
Log analysis questions present raw log output and ask you to identify what happened, classify the event type, or determine the appropriate response.
Common Log Sources Tested
- Authentication logs (failed logins, brute force indicators)
- Firewall logs (blocked connections, port scans)
- Web server logs (SQL injection attempts, directory traversal)
- DNS logs (unusual query patterns, potential exfiltration)
The Reading Approach That Works
Don't try to read every line. Scan for anomalies first:
- Repeated failed authentication from a single IP
- Sequential port access patterns indicating a scan
- Requests containing characters like
',--,../in URLs - Unusually high outbound DNS query volume to a single domain
Example: A log shows 192.168.1.100 - - [10/May/2025:14:23:01] "GET /admin/config.php?user=' OR '1'='1 HTTP/1.1" 500 – that’s a likely SQL injection attempt, not a simple misconfiguration.
Once you identify the pattern, classify it: brute force, reconnaissance, injection attempt, or data exfiltration. Name the attack type before selecting your answer.
Network Diagram PBQs
These present a topology and ask you to place security controls correctly, identify where a threat entered, or determine which segment is exposed.
What to Look For
- DMZ placement relative to the internet and internal network
- Where firewalls, IDS/IPS, and proxies sit in the traffic flow
- Which hosts are reachable from which segments
- Single points of failure or missing controls
Work from the outside in. Start at the internet-facing edge and trace the path inward. Any segment reachable from the internet without a control layer in between is the exposure the question is pointing at.
How to Handle PBQs on Exam Day
- Don't skip them entirely. Flagging and returning costs time. Attempt each PBQ, place your best answer, flag if uncertain, and move on.
- Read scenario requirements before touching the interface. Jumping straight into configuration without understanding all constraints is how you build a solution that satisfies four of five requirements.
- Time‑box yourself (aim for ~3 minutes per PBQ). If you're stuck after that, place your best attempt, flag it, and move forward.
Building PBQ Readiness Before Exam Day
The only way to get comfortable with PBQs is to practice tasks, not read about them.
That means:
- Working through firewall rule scenarios until the ordering logic is automatic
- Reading sample logs regularly until pattern recognition becomes fast
- Drawing network topologies from memory and identifying control gaps
Scenario-based practice that forces you to apply concepts rather than recall them is what closes the PBQ gap. ExamOS includes scenario-driven Security+ practice built around exactly this kind of applied reasoning, so the decision-making process feels familiar before the exam clock starts.
The Underlying Skill
PBQs exist because CompTIA wants to verify that certified professionals can function in real environments, not just pass a test.
The candidates who handle them well aren't necessarily the ones who studied the most. They're the ones who practiced the right way: working through applied scenarios consistently, building the pattern recognition that makes log analysis fast, and developing the systematic thinking that makes firewall configuration feel routine.
That's a habit, not a sprint. Build it before exam day.
Preparing for Security+ and want scenario-based practice that covers PBQ-style reasoning alongside standard exam domains? Explore Security+ practice on ExamOS and find out where your applied knowledge holds up under pressure.
👉 Related Links
Top 5 cybersecurity certificationsTop