Security+ performance-based questions, explained

What a PBQ is

CompTIA describes performance-based questions as items that test your ability to solve problems in real-world settings. They come in two forms: simulations, which imitate a tool such as a firewall or a terminal with limited functionality, and virtual environments, which are full working systems. CompTIA lists Security+ among the exams that use simulations only.

Both versions of the exam, SY0-801 and SY0-701, have up to 90 questions in 90 minutes, a mix of multiple-choice and performance-based. CompTIA doesn’t publish how many of them are PBQs, how much each one is worth or where they sit in the exam. Candidates commonly report a few near the start, which is why the practice exams in this course open with them.

How the simulations behave

CompTIA’s own guidance on simulation PBQs, as of October 2026:

• More than one right path. A simulation has restricted functionality, but it is built to accept several valid ways of reaching the solution. What is scored is whether you reach a correct result.
• Partial credit is possible. CompTIA says partial credit may be offered on some questions, without saying which. A mostly finished PBQ can earn something; a blank one can’t.
• A reset button. It clears your work on that question only, so you can start it again without touching anything else.
• Skip and come back. You can leave a simulation and return to it later. Your work is saved as you go and when you move to another question.
• Instructions you can move. The instructions panel can be minimised, moved and resized, so it doesn’t have to cover the part of the screen you are working in.

CompTIA has a sample simulation on its performance-based questions page. Trying it once shows you the interface before exam day.

What they ask you to do

CompTIA doesn’t publish a list of PBQ topics. The best guide is the objectives themselves: the ones that begin “Given a scenario” ask you to apply what you know to a situation rather than recall it, and that is what a hands-on task tests. SY0-801 has more of them, 9 of its 27 objectives against 7 of 28 in SY0-701: change management, vulnerability management and automation become applied objectives too.

SY0-801

• 1.2 Given a scenario, demonstrate the impact of change management processes on security.
• 2.5 Given a scenario, analyze indicators of malicious activity.
• 3.2 Given a scenario, manage the security architecture to best protect the infrastructure.
• 4.1 Given a scenario, apply mitigating controls, techniques, and solutions to secure the environment.
• 4.3 Given a scenario, perform tasks associated with vulnerability management.
• 4.5 Given a scenario, apply concepts related to identity and access management.
• 4.6 Given a scenario, apply automation and orchestration solutions to secure operations.
• 4.8 Given a scenario, use data, artifacts and sources to support a security investigation.
• 5.6 Given a scenario, apply security awareness concepts to improve organizational security.

SY0-701

• 2.4 Given a scenario, analyze indicators of malicious activity.
• 3.2 Given a scenario, apply security principles to secure enterprise infrastructure.
• 4.1 Given a scenario, apply common security techniques to computing resources.
• 4.5 Given a scenario, modify enterprise capabilities to enhance security.
• 4.6 Given a scenario, implement and maintain identity and access management.
• 4.9 Given a scenario, use data sources to support an investigation.
• 5.6 Given a scenario, implement security awareness practices.

In both versions their sub-topics suggest tasks such as writing or ordering firewall rules to meet a set of requirements, reading log entries to find an attack and the host it came from, placing devices such as a jump server, a sensor or a load balancer in the right network zone, assigning access by least privilege, and deciding how to handle a reported phishing message. SY0-701 also lists secure wireless settings (WPA3, RADIUS, an authentication protocol). The objectives pages for SY0-801 and SY0-701 list every sub-topic.

A worked example

A task of the kind the firewall objectives describe, written for this page (it is not from the exam):

One solution

1. Allow TCP 22 (SSH) from 10.0.50.0/24 to 172.16.10.20
2. Allow TCP 443 (HTTPS) from any to 172.16.10.20
3. Deny all traffic from any to 172.16.10.20

Why it is built this way

• Order matters. With first-match processing, a deny at the top would block everything below it. The specific allows go first and the catch-all deny last. Rules 1 and 2 don’t overlap, so either can come first: one of the several valid paths a simulation accepts.
• Least privilege. SSH is allowed from the management network only. Allowing it from any address would still meet requirement 2, and break requirement 3.
• The right port and protocol. HTTPS is TCP 443 and SSH is TCP 22. Allowing TCP 80 as well would serve the site without encryption, which the task rules out.
• The final deny. Rule 3 repeats what the implicit deny already does. It is still worth writing: it makes the intent visible to whoever edits the rules next, and on some firewalls it is the only way to log what gets dropped.
• No rules for replies. A stateful firewall lets the responses to an allowed connection back in by itself, so the table needs no rules for return traffic.

How to approach them

1. Read every requirement before you touch anything. A PBQ is judged against all of its requirements, and a later one can change what an earlier one means.
2. Decide quickly whether to do it now. If a simulation looks long, skip it and come back after the multiple-choice questions. Your work is kept, and the minutes one simulation can swallow are worth several other questions.
3. Finish what you can. Partial credit may be available, so a mostly right answer is worth leaving in place. Don’t leave a PBQ blank.
4. Reset deliberately. If you have lost track of what you changed, a reset puts that one question back to its starting state.
5. Check your answer the way the system would. For a rule table, trace two or three connections through your rules from the top. For a placement task, ask what each device needs to see and who must not reach it.

The exam guide covers how to split the 90 minutes between PBQs and multiple-choice questions.

Practising PBQs

Reading about PBQs helps less than doing them until the interface is boring. The course has 76 hands-on tasks for SY0-801 (70 for SY0-701) in six simulators, each with an explanation for every part of the answer and a reset for that question alone, as on the exam:

• Investigation. Click the systems on a network diagram to open their windows of evidence (a log, a terminal whose commands you run, a configuration file, a ticket), identify the attack and the best response on each, and select the hosts the attacker actually reached. This is the style of CompTIA’s own sample simulation.
• Triage. Work through a vulnerability scan, an alert queue or an access review row by row, deciding each finding against the organisation’s own policy and asset list in the tabs beside it.
• Firewall rules. Build an access-control list row by row, or fix one that a change left broken, then a set of test connections runs through it, and each one that fails says why.
• Log analysis. Flag the suspicious entries in a log excerpt, then answer questions about what happened.
• Network placement. Drag devices onto a network diagram, with feedback for every position.
• Wireless security. Configure an access point’s settings to meet a set of requirements.

Each practice exam opens with PBQs, so its first minutes feel like the real exam’s. The free lesson includes a firewall simulation; no account needed.