While multiple-choice questions dominate the CompTIA Security+ exam, Performance-Based Questions (PBQs) are the true test of your practical skills. These aren't just about picking the right answer from a list; they require you to perform a task or solve a problem in a simulated environment.
Think of PBQs as virtual labs. You might be asked to configure a firewall, set up a secure wireless network, or drag-and-drop steps of an incident response plan in the correct order. They test your ability to apply what you've learned, not just memorize definitions.
How Many PBQs to Expect?
The Security+ exam consists of a maximum of 90 questions, and you have 90 minutes to complete them.
⚠️ Important: PBQs almost always appear at the very beginning of the exam.
Typically, candidates see between 1 and 10 PBQs, with 4 to 5 being the most common number. Because they are more complex and require interaction, they naturally take more time to complete than standard multiple-choice questions. It's crucial to manage your time effectively so you don't get stuck on them right out of the gate.
How Are PBQs Scored?
CompTIA keeps the exact scoring algorithm confidential, but here is what we do know:
- Partial Credit is Possible: For multi-step problems, you may receive credit for the parts you get right, even if you miss others. However, CompTIA does not officially confirm which specific questions offer partial credit.
- Multiple Paths: In simulation style questions (like configuring a router), there may be more than one way to achieve the correct result (e.g., using the command line vs. a GUI). As long as the end state is correct, you should receive credit.
What Do Security+ PBQs Look Like?
1. Scenario-Based Networking Simulations
These are often considered the most challenging. You might be presented with a network diagram and tasked with securing it.
Task Example: "Configure the Access Control List (ACL) on the router to permit HTTP traffic to the Web Server in the DMZ but deny all other traffic from the internet."
2. Fill-In-The-Blank
These questions test your specific knowledge of configurations, ports, or command syntax.
In this example, you would need to know the specific requirements and features of RAID 10 (Minimum 4 drives, striping and mirroring supported, but no parity).
3. Drag-And-Drop
You will often see these for processes or matching terms. A common example is the Incident Response Lifecycle.
Task Example: "Drag the Incident Response steps from the left and place them in the correct order on the right."
Best Way to Approach PBQs
Flag for Later
Since PBQs are time-consuming and appear first, many successful candidates skip them initially. Use the "Mark for Review" feature, blast through the multiple-choice questions you know, and then come back to the PBQs with your remaining time.
Read Instructions Carefully
It sounds obvious, but PBQ instructions can be dense. Missed details (like "use the last usable IP address") are a common reason for failure.
Don't Panic on Reset
Most simulations have a "Reset" button. If you mess up a configuration, you can usually verify if you need to start fresh. Just be mindful of the clock.
Frequently Asked Questions
Can I get partial credit on PBQs?
CompTIA does not officially disclose this for every question, but it is widely believed and sometimes stated that partial credit is awarded for complex, multi-part questions.
Are PBQs harder than multiple choice?
Most students find them harder because they require active problem solving rather than recognition. They also carry a higher cognitive load due to the interface.
How much are PBQs weighted?
The exact weight is secret, but given their complexity, they are significant. Doing well on PBQs can provide a strong buffer for the rest of the exam.