Security+ performance-based questions

What a PBQ is on this exam

Multiple choice, multiple response, and performance-based questions. The performance-based items drop you into a simulated console, network diagram, or configuration screen and score what you actually do.

CompTIA, Security+ exam details ↗

Ours are written from the published objectives, never from anyone’s memory of a live exam. What follows is what each shape asks you to do.

The four shapes

• Matching

  14 tasks

  Pair each item with the one that fits it, from a pool holding more options than slots, so the last pair cannot fall out by elimination.

• Sequencing

  11 tasks

  Put steps in the order a process actually runs. Getting the steps right and the order wrong scores the way it does on the exam, which is partly.

• Sorting

  9 tasks

  Drop each item into the category it belongs to. Several items per category, so knowing one does not give you the rest.

• Log and output analysis

  6 tasks

  Read a log extract, a config, or a network diagram, and answer what it shows. The artifact is on screen and the answer is in it.

Every task is scored slot by slot, so a sequence with two steps out of place is not marked the same as one with none right. Partial credit is how the real exam scores these, and a practice set that marks them all-or-nothing tells you less than the number it prints.

Coverage against the published blueprint

CompTIA publishes the weight of each domain. The set is written to those weights rather than to whichever domain is easiest to build a task from, which is the difference between a sample of the exam and a pile of exercises.

• General Security Concepts5 tasks · 12% of the exam
• Threats, Vulnerabilities, and Mitigations9 tasks · 22% of the exam
• Security Architecture7 tasks · 18% of the exam
• Security Operations11 tasks · 28% of the exam
• Security Program Management and Oversight8 tasks · 20% of the exam

What each answer rests on

Every task carries the page its answer was checked against, and the link is in the walkthrough where you can open it. Here they are up front, so you can check us before starting rather than after.

• NIST23 pages · 30 tasks
• cisa.gov2 pages · 2 tasks
• MITRE ATT&CK2 pages · 2 tasks
• OWASP1 page · 2 tasks
• CIS1 page · 1 task
• eur-lex.europa.eu1 page · 1 task
• IETF1 page · 1 task
• Microsoft1 page · 1 task

• NIST SP 800-53, Security and Privacy Controls3 tasks
• NIST SP 800-12, An Introduction to Information Security2 tasks
• NIST SP 800-161, Supply chain risk management2 tasks
• NIST SP 800-30, Guide for Conducting Risk Assessments2 tasks
• NIST SP 800-41, Firewall policy guidelines2 tasks
• NIST SP 800-88, Media Sanitization2 tasks
• OWASP Top 10, Broken access control2 tasks
• CIS Benchmarks, secure configuration guidance1 task
• CISA, Cross-Sector Cybersecurity Performance Goals1 task
• CISA, Recognize and Report Phishing1 task
• Microsoft Learn, Email authentication in Microsoft 365 (SPF, DKIM, DMARC)1 task
• MITRE ATT&CK framework1 task
• MITRE ATT&CK, Password spraying1 task
• NIST glossary, brute force password attack1 task
• NIST glossary, Data states1 task
• NIST SP 800-123, Guide to General Server Security1 task
• NIST SP 800-137, Information Security Continuous Monitoring1 task
• NIST SP 800-175B Rev. 1, Guideline for Using Cryptographic Standards1 task
• NIST SP 800-207, Zero Trust Architecture1 task
• NIST SP 800-218, Secure Software Development Framework1 task
• NIST SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems1 task
• NIST SP 800-34, Contingency Planning Guide1 task
• NIST SP 800-40, Enterprise patch management1 task
• NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program1 task
• NIST SP 800-53A Rev. 5, Assessing Security and Privacy Controls1 task
• NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management1 task
• NIST SP 800-61, Incident handling guide1 task
• NIST SP 800-63B, Authentication and lifecycle management1 task
• NIST SP 800-92, Guide to Computer Security Log Management1 task
• NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems1 task
• Regulation (EU) 2016/679 (GDPR), Article 4 definitions and Article 171 task
• RFC 3227, Evidence collection and archiving1 task

Every source behind the SY0-701 question bank