What should I expect from Security+ performance-based questions, and how should I approach them?

What does a Security+ PBQ test?

A Security+ PBQ tests whether you can apply knowledge to a practical task. That could involve interpreting evidence, choosing appropriate controls or completing a configuration in an exam interface. The official SY0-701 objectives confirm a mix of multiple-choice and performance-based questions.

You’re preparing to use the topics, not memorise a provider’s exact screen. A firewall exercise can test traffic direction, ports and least privilege together. An investigation exercise can require you to connect several clues and choose a response.

The examples in this guide are original practice scenarios, not recalled exam items. They teach the decisions that help you work with an unfamiliar interface.

Evidence tasks are easier to interpret when you distinguish scanning, testing, hunting and risk assessment by the question each answers.

What should I read before making any changes?

Read the required outcome, the systems you may change and the constraints before making changes. A task might require allowing one service while keeping a sensitive subnet isolated. Opening all traffic would satisfy only part of that need.

Turn the task into a short checklist. Name the approved source, destination and service. Identify any explicitly forbidden path. Read the interface instructions, including whether changes need saving and how you may move between questions.

Then examine the supplied diagram, logs or settings. If the evidence shows a workstation talking directly to a database, trace that path rather than changing unrelated settings. Work from the evidence you have; don’t invent an extra incident.

For access-control tasks, separate identity checks, permission checks and activity records before changing a role or login setting.

For a suspicious-login task, use the channel and credential pattern to classify the attack.

How would I solve an original firewall practice task?

Solve a firewall practice task by translating each requirement into a narrow rule, then checking rule order and the default action. Consider this simplified exercise: internet users may reach a public web server over HTTPS; that web server may reach its database over TCP 5432; internet users must have no direct database access.

The two required allowances are public-client-to-web-server TCP 443 and web-server-to-database TCP 5432. A deny policy must block the direct public-to-database path. TCP 5432 is used here for the example database service; use the port stated in your actual task.

If the rule engine uses first match, put required narrow rules before a broad deny. If it is stateful, return traffic for an allowed connection may already be covered. Follow the model the task supplies rather than assuming every product works the same way.

Scroll sideways to see every column.

Should I skip a PBQ and come back later?

Consider returning later only if the exam interface permits it and the task is consuming time you need elsewhere. Read the on-screen navigation instructions first. Don’t assume every task or exam format allows the same movement.

SY0-701 allows up to 90 questions in 90 minutes, so spending a large part of the session on one unclear task can leave other questions unanswered. A personal practice strategy might reserve a final review window and mark a difficult task for return where available. That is a planning aid, not an official per-question time limit.

During preparation, time yourself on original exercises and notice where you stall: reading the diagram, recalling a port, interpreting a log or operating the interface. Fix the skill that caused the delay.

If an unsuccessful exam attempt exposed a reading, recall or timing problem, use the next steps after failing Security+ to turn that observation into a focused recovery session.

How should I check a completed PBQ?

Check a completed PBQ against each requested outcome, including any requirement to preserve access or deny a path. A configuration that blocks everything can be secure-looking and still fail the task.

For a firewall exercise, test the allowed and denied paths in your reasoning. For a sequencing exercise, check dependencies: collect needed evidence before a destructive action, unless immediate containment is required by the stated situation. Incident response isn’t always a rigid list.

Inspect every requested field and any save or apply control. Complete what you can justify, but don’t rely on a promised partial-credit amount or a fixed PBQ count. Scoring and item selection shouldn’t be inferred from a practice provider’s marks.

An investigation task may ask you to select IDS, SIEM, SOAR or EDR capabilities from the requested action and evidence location.

If the task includes a file comparison or a protected value, identify whether hashing, encryption or encoding is involved.

For a cryptography task, name who signs, who verifies and who decrypts before selecting a public or private key.

How should I practise before the exam?

Practise by doing tasks and explaining why each decision works. Use safe labs or original exercises to configure narrow firewall rules, read sample logs, assign least-privilege access and connect controls to a network diagram.

Start with how the network controls work together, then recall the ports and protocols without looking at a table. Change the scenario and check whether your reasoning still works.

CompTIA Security+ Practice includes a firewall exercise alongside concept lessons and explained questions. Its app preview shows the current learning tools and store availability.

For numerical tasks, practise loss formulas, recovery targets and reliability averages with the units shown explicitly.

For a task with several access sources, try fixing user permissions. For a failed service request, try tracing the broken connection. Each includes fictional evidence, a response sheet and a separate worked answer.

Then try securing the wireless network, where you must preserve useful access while refusing guest access to internal systems. Change one requirement and retest the paths to check your understanding.

How should I plan Security+ study around my other certifications?

Plan your study around the knowledge you need and the certification rules that apply to you. Start by checking whether you can take Security+ without A+ or Network+, then compare Network+ and Security+ as first study choices if you need to build networking foundations.

If you already hold a lower-level certification, check what passing Security+ changes for A+ and Network+ renewal. Keep that certification decision separate from choosing the lessons and practical tasks that address your current gaps.

How should I prepare for the exam appointment?

Prepare for the appointment by confirming the requirements of your chosen delivery method alongside your remaining revision. Compare online and test-centre Security+ delivery before relying on a particular device, room or travel plan.

Use the final-week revision plan to keep those arrangements alongside targeted recall and practical work. Booking preparation and demonstrated understanding are separate checks; both need attention before exam day.