SecurityMocks

PBQ practice · SY0-801

Security+ PBQs in 2026: how performance-based questions work

PBQs are simulations. Instead of picking a letter, you configure firewall rules, read logs or place controls on a network. CompTIA doesn’t publish how many you’ll get, and passers say they’re the hardest part of CompTIA Security+®. Here’s how they work and how to practice them.

Try a firewall PBQ free See the six formats

The basics

What is a PBQ on Security+?

A performance-based question gives you a task to finish in a simulated tool. The first five facts come from CompTIA; the last is what candidates report.

  • Simulations, not VMs

    A simplified version of a tool or environment, with limited functions. Security+ doesn’t use full virtual machines.

  • Skip and return

    You can skip a simulation PBQ and come back to it later in the exam.

  • A reset button

    Each simulation can be reset to its starting state if you get tangled.

  • Partial credit

    Some PBQs give partial credit, and any valid way of solving the task earns credit.

  • Number not published

    CompTIA doesn’t say how many you’ll get, and expects the number to grow over time.

  • Usually up front

    Candidates commonly report a handful of PBQs near the start of the exam.

PBQ formats

The six Security+ PBQ formats we practice

Candidates report these task types again and again. We build each one from the SY0-801 objectives, grade the end result rather than one fixed answer, and score every part separately.

Firewall and ACL rules · objective 4.1 FlagReset

Firewall and ACL rules

Edit a rule table where order matters and an implicit deny sits at the bottom. We run test connections through your rules to grade them.

Requirements
  1. Internet hosts can reach the mail relay 10.10.2.25 over SMTP (TCP 25).
  2. Only the monitoring server 10.10.9.4 may poll the switches in 10.10.0.0/28 with SNMP (UDP 161).
  3. Deny everything else.
#ActionProtoSourceDestinationPortCheck
1ALLOWTCPANY10.10.2.2525Pass
2ALLOWUDPANY10.10.0.0/28161Fail
3DENYANYANYANYANYPass
Partial credit: 2 of 3 requirements

Rule 2: any host can poll the switches with SNMP. Requirement 2 allows only the monitoring server, so a test connection from 10.20.0.31 should have been denied. Set the source to 10.10.9.4.

How it’s graded: one point per requirement. A requirement scores when every test connection tagged with it gets the right allow or deny result, so any rule table that works earns full marks.

Log analysis · objective 2.5 FlagReset

Log analysis

Select the lines that show the attack, then answer questions about it. A harmless look-alike line keeps you honest.

  1. 198.51.100.77 - - [18/Nov/2026:10:02:11 +0000] "GET /reports/q3-summary.pdf HTTP/1.1" 200 48211
  2. 203.0.113.50 - - [18/Nov/2026:10:02:15 +0000] "GET /download?file=invoice-2291.pdf HTTP/1.1" 200 15874
  3. 203.0.113.50 - - [18/Nov/2026:10:02:19 +0000] "GET /download?file=../../../../etc/passwd HTTP/1.1" 200 2817
  4. 203.0.113.50 - - [18/Nov/2026:10:02:21 +0000] "GET /download?file=../../../../etc/shadow HTTP/1.1" 403 199
  5. 203.0.113.50 - - [18/Nov/2026:10:02:24 +0000] "GET /download?file=..%2f..%2f..%2fapp%2f.env HTTP/1.1" 200 734
  6. 10.20.0.12 - - [18/Nov/2026:10:03:02 +0000] "GET /admin/export?file=nightly-backup.tar.gz HTTP/1.1" 200 104857600
Attack named: Directory traversal
Lines: 2 of 3 found, no false alarms

Line 5 hides the same attack: %2f is an encoded slash, so ..%2f is ../ in disguise. Line 6 is the look-alike: an internal admin downloading a named backup, with no ../ in the path.

How it’s graded: the lines you select are scored on precision and recall, so false alarms cost marks as well as misses. Each follow-up question, such as naming the attack or choosing the next step, is scored on its own.

Network placement · objective 3.2 FlagReset

Network placement

Put each control where the traffic it has to inspect or block actually passes. The device pool is bigger than the number of slots.

Requirements
  1. Block exploit traffic before it reaches any internal zone.
  2. Filter attacks on the customer portal’s web forms.
  3. Only authenticated devices may use wall ports.
  4. Remote staff get filtered web and app access without a full VPN.
Internet edgeTraffic from the internetIDS
Web tierCustomer portalWAF
Staff LANDesks and meeting rooms802.1X
Remote staffLaptops at home and awaySSE
Partial credit: 3 of 4 slots

IDS: it watches and alerts but doesn’t block. Requirement 1 says exploit traffic must be stopped at the edge, so that slot needs an inline IPS. An IDS fits on a mirrored port instead.

How it’s graded: one point per slot. Where more than one device meets a requirement, every defensible choice is accepted.

Matching · objective 4.6 FlagReset

Matching

Pair short scenarios with the concept they show. Drag and drop, or click to place with a keyboard.

  • An AI agent pulls the logs, enriches the alert and isolates the laptopAgentic AI
  • A model forecasts which open vulnerabilities are likely to be exploited nextPredictive analysis
  • An assistant drafts the incident summary for an analyst to editChatbot
  • Learns what normal looks like for each server and keeps updating itPredictive analysis
Partial credit: 3 of 4 pairs

Last pair: learning and updating what’s normal is an AI-augmented baseline. Predictive analysis forecasts what happens next; it doesn’t define normal.

How it’s graded: one point per pair. There are more labels than targets, so you can’t win the last pair by elimination.

Access-control matrix · objective 4.5 FlagReset

Access-control matrix

Set each role’s access to each resource, from No access to Full control, so the requirements hold with the least privilege.

Requirements
  1. Payroll clerks edit payroll records but have no access to payment runs.
  2. Finance managers release payment runs and can view, not edit, records.
  3. Internal auditors can read everything and change nothing.
RolePayroll recordsPayment runsAudit log
Payroll clerkModifyModifyNo access
Finance managerReadModifyNo access
Internal auditorReadReadRead
Partial credit: 8 of 9 cells

Clerk × payment runs: the person who edits payroll records shouldn’t also release the payments. That’s separation of duties, so the cell should be No access.

How it’s graded: one point per cell. Every matrix tests least privilege plus at least one separation-of-duties or MFA decision.

Tool-output interpretation · objective 4.3 FlagReset

Tool-output interpretation

Read a vulnerability scan report and decide what to do with each finding. Exposure and asset value matter as much as the score.

FindingAssetCVSSExposureAction chosen
Remote code execution in web frameworkweb01, customer portal9.8 CriticalInternet-facingPatch now
SSH version flagged from its banner; vendor notes a backported fixbuild028.1 HighInternalPatch now
Weak TLS ciphers allowedhr-app015.3 MediumInternalNext window
Partial credit: 2 of 3 decisions

build02: the scanner matched the version banner, but the vendor backported the fix to this package. Verify the installed package, then mark it a false positive and record why.

How it’s graded: one point per decision. Every report hides at least one false positive for you to spot.

Every PBQ ends with a debrief that explains each rule, line, placement, pair or cell. Drag-and-drop tasks also work by keyboard or click-to-place.

Time budget

How much time to give Security+ PBQs

In older material, CompTIA estimated that PBQs were about 10% of the items but took about a third of the exam time. It hasn’t published a newer figure, so use it as a planning guide.

A PBQ strategy many passers use

Flagging the PBQs and finishing them last comes up again and again in passers’ posts.

  1. Look first

    Open each PBQ and read the task. If one is quick, finish it while it’s fresh.

  2. Flag the long ones

    Flag any PBQ that will take a while and move on. You can come back to simulations.

  3. Bank the multiple choice

    Answer the multiple-choice questions at a steady pace, flagging any you want to revisit.

  4. Return with the clock

    Spend what’s left on the flagged PBQs. Reset if you get tangled, and finish what you can: every correct part can count.

It’s a habit, not a rule. If PBQs are your strength, doing them first may suit you better. Practice both ways on a timed mock test and keep the one that leaves you time to spare.

Free PBQ practice

Try a real firewall PBQ now

Our 10-minute demo opens with a firewall PBQ from the question bank, then three multiple-choice questions. No sign-up, and you get the full debrief at the end.

Illustration of server racks and a laptop joined by paths of small packets that lead to an arch-shaped gateway
  • 1 firewall PBQ
  • 5 requirements
  • 13 test connections
  • 3 multiple-choice questions
  • 10 minutes
  • Partial credit
Start the demo Full mock with 4 PBQs

FAQ

Security+ PBQ questions, answered

What are PBQs on Security+?

Performance-based questions (PBQs) are simulations where you complete a task instead of choosing an answer, such as writing firewall rules, analyzing a log or placing security devices on a network. Security+ uses simulations of a tool or environment, not full virtual machines.

How many PBQs are on the Security+ exam?

CompTIA doesn’t publish the number, and says it expects the number of PBQs to grow over time. Candidates commonly report a handful, usually near the start of the exam. Our full mock tests include four.

Do Security+ PBQs give partial credit?

Some do. CompTIA says some PBQs may offer partial credit while others may not, and that any valid solution to the task earns credit. On our PBQs, every requirement, slot, pair or cell is scored separately.

Should I do the Security+ PBQs first or last?

Many passers flag the PBQs, answer the multiple-choice questions, then return to the PBQs with the time left. You can skip a simulation PBQ and come back to it. If PBQs are your strength, doing them first is fine; just keep an eye on the clock.

Can you go back to a PBQ on Security+?

Yes. CompTIA says you can skip simulation PBQs and return to them later, and each one has a reset button that takes it back to its starting state.

Where can I practice Security+ PBQs for free?

Our free demo includes a firewall PBQ, and free Mock Test 1 starts with four PBQs, each with partial credit and a step-by-step debrief. Across our mock tests, PBQs cover six formats.

Practice PBQs under exam conditions

Mock Test 1 is free: four PBQs first, then the multiple-choice questions, with partial credit and a debrief for every part.

Start free Mock Test 1 Try the demo PBQ
Illustration of a magnifying glass over a fan of answer cards, one marked with a tick and one with a cross