How to Approach Security+ PBQs on the SY0-701 Exam
Performance-based questions (PBQs) are the part of Security+ that people worry about most. Instead of picking A, B, C or D, you do something: fill in a firewall rule table, tag log lines, drag devices onto a network diagram, or put steps in order. They look harder than they are. Most of the trouble comes from the clock and from misreading the task, and both can be fixed with a plan you decide before exam day.
This guide covers that plan. It sticks to what CompTIA has published about PBQs and says so where something isn't public.
What CompTIA actually says about PBQs
Start with the official facts, because a lot of exam advice online is guesswork repeated until it sounds true.
From CompTIA's SY0-701 exam page: the exam has a maximum of 90 questions, a mix of multiple-choice and performance-based questions, and you get 90 minutes. The passing score is 750 on a scale of 100 to 900. The English version of SY0-701 retires on June 11, 2027.
From CompTIA's performance-based questions page:
- Security+ uses simulation PBQs. A simulation is a simplified version of a tool or environment, such as a firewall, network diagram, terminal or operating system.
- You can skip a simulation PBQ and come back to it later. Your work is saved as you go and when you move to another item.
- Simulations have a reset button.
- There can be more than one way to solve a PBQ, and scoring accounts for different approaches.
- CompTIA states that partial credit may be given.
That last point needs care. CompTIA says partial credit may be given, but it does not publish how any PBQ is scored: which parts count, how much each is worth, or whether a given question awards partial credit at all. Plenty of prep sites state confidently that "every blank is scored separately." That isn't something CompTIA has confirmed. The safe takeaway: never leave part of a PBQ blank, but don't build your strategy on a scoring scheme nobody outside CompTIA can see.
CompTIA also doesn't publish how many PBQs appear on a given exam, so treat any exact number you read as a guess.
Decide your time plan before you sit down
With up to 90 questions in 90 minutes, you have about a minute per question on average. A PBQ can easily take five to ten minutes. That's why the order you work in matters.
A plan that works for many candidates:
- Look at each PBQ briefly when it appears. Spend 20 to 30 seconds reading the task. If you can see exactly what's being asked and it's a quick one (a short drag-and-drop, for example), do it now.
- Flag and skip anything that will take longer. Because simulation work is saved, skipping costs you nothing.
- Work through the multiple-choice questions. These are where you bank points quickly.
- Return to the flagged PBQs with a known time budget. You now know exactly how many minutes are left, which is much calmer than guessing at the start.
Before you skip, check the navigation on your exam screen. Make sure the Next and Previous buttons and the review screen behave the way you expect so you can actually get back to flagged items.
One more rule: give each PBQ a hard time cap when you return to it. If you've spent your cap and one part still won't come together, enter your best answer for every remaining field and move on. A perfect PBQ is not worth three unanswered multiple-choice questions.
Read the scenario twice, then restate it
Most wrong PBQ answers come from solving a slightly different problem than the one asked. Two passes help.
First pass: what am I looking at? Is it a rule table, a log, a diagram, a settings panel, or a list to sort? What system is involved, and what is the stated goal?
Second pass: what are the constraints? Look for the words that narrow the answer:
- "only" and "nothing else" (least privilege; block everything not listed)
- "from the LAN" or "from the admin workstation" (the source matters, not just the port)
- "securely" or "encrypted" (pick SSH over Telnet, HTTPS over HTTP, LDAPS over LDAP)
- "first" or "best" (there may be several reasonable actions; the question wants one)
Then restate the task in one plain sentence before touching anything. For example: "Let anyone reach the web server on 443, let only the LAN reach it on 22, block the rest." If you can't write that sentence, you haven't finished reading.
Work the PBQ in a fixed order
Each PBQ type rewards a slightly different routine, but the same order works for all of them.
- List what "done" looks like. Write the requirements on your scratch material as a short checklist.
- Do the parts you're sure of first. Fill in the obvious placements, ports or tags. This shrinks the problem.
- Use elimination on the rest. In matching and configuration tasks, the wrong choices are often the insecure twin of the right one: Telnet instead of SSH, HTTP instead of HTTPS, FTP instead of SFTP.
- Check your answer against the checklist. For a rule table, trace each requirement through your rules from the top. For a log, reread each line you tagged as benign.
- Leave nothing empty. Even if you're unsure, an answer has a chance; a blank has none.
Don't reach for the reset button unless your work has truly gone off the rails. Resetting wipes everything, including the parts you had right.
How the common PBQ types differ
You'll move faster if you recognize the type in the first few seconds. These are the formats you can practice on PBQ Lab, and each lines up with a skill in the SY0-701 objectives.
- Firewall rules. An ordered rule table where the first matching rule wins and unmatched traffic is denied. This ties to objective 4.5 (firewall rules, access lists, ports/protocols, screened subnets). Our firewall rule PBQ walkthrough covers it step by step, and you can try the free Publish the web server question.
- Log analysis. Tag log lines with the attack they show, or mark them benign. This ties to objectives 2.4 (indicators of malicious activity) and 4.9 (using log data in an investigation). See the log analysis PBQ walkthrough and the free Read the web server log question.
- Network placement. Put the firewall, WAF, IPS, IDS and similar devices where they do their job (objective 3.2). Try Place the security devices.
- Drag and drop. Match ports to services, controls to control types, and so on. Try Ports for the new jump host.
- Configure settings. Harden a system in a simulated settings panel. Try Harden the new web server.
- Put in order. Sequence steps, such as collecting evidence from most to least volatile. Try Collect the evidence in the right order.
Practice the way the exam feels
Reading about PBQs builds familiarity. Doing them builds speed. A few habits make practice count:
- Time yourself. Give each practice PBQ a cap, say six minutes, and stop when it runs out. You're training the decision to move on as much as the skill itself.
- Say the reasoning out loud. For a log line, say what connected, from where, to what, and whether that's normal. For a rule, say which connections it lets through.
- Review the objective, not just the answer. When you miss something, find the matching line in the official SY0-701 exam objectives and study the whole bullet, not only the item you missed.
- Skip brain dumps. Leaked or "real exam" questions break CompTIA's candidate agreement and teach you to memorize wording instead of solving problems. Everything on PBQ Lab is original practice, not real exam content.
A short checklist for exam day
- Read each PBQ's task when it appears; do it now only if it's quick.
- Flag the rest and come back after the multiple-choice questions.
- Read the scenario twice and restate it in one sentence.
- Do the sure parts first, then eliminate the insecure options.
- Trace your answer against every requirement.
- Never leave a field blank, and respect your time cap.
When you're ready to try it, start with the free practice questions. They're checked in your browser the moment you press Check, and each one shows the exam objective it covers.