PBQ Workflow and Timing

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

PBQ Workflow and Timing

Key Takeaways Explain This Topic AI

SY0-701 delivers up to 90 questions in 90 minutes, so you have roughly one minute per item and PBQs eat that budget fast.

PBQs appear first; do the mechanical ones, flag long or confusing ones, and protect the multiple-choice points.

Use a fixed five-pass method: read the task verb, scope it, baseline what is already correct, apply the smallest secure change, then verify.

Apply Security+ defaults: least privilege, secure protocols, deny by default, evidence preservation, and stated business constraints.

Before submitting, confirm direction, source, destination, identity, protocol, and rule order for every required object.

Last updated: June 2026

What a PBQ Actually Is

Performance-based questions (PBQs) are interactive tasks that ask you to apply Security+ skills rather than recall a fact. On the SY0-701 exam you may drag controls onto a diagram, build or reorder firewall rules, assign IAM (identity and access management) roles, read a log set and pick the next action, classify risk, or order incident-response steps. CompTIA delivers up to 90 questions in 90 minutes with a passing score of 750 on a 100-900 scale . The exam is not pass/fail by raw percentage; it is scaled, so missing a hard PBQ is survivable if you bank the easier multiple-choice points.

Timing Math You Must Internalize

Ninety items in ninety minutes is about 60 seconds per question . PBQs typically consume 3-6 minutes each, and you usually see 2-5 of them clustered at the start. If five PBQs each eat five minutes, that is 25 minutes gone before you touch a single multiple-choice item. The fatal exam-day error is grinding on the first PBQ until the clock is bleeding.

• Situation Recommended action Time guardrail
• PBQ is familiar and mechanical Complete it now Cap at ~4 minutes
• PBQ is long but understandable Do the obvious parts, flag, return later Bank partial credit first

PBQ is confusing after one careful read Flag immediately, answer later with fresh context Do not exceed 2 minutes deciding

Multiple-choice section untouched Protect that time; MCQs are faster points Reserve ~50 minutes

Many PBQs award partial credit , so a half-correct firewall ruleset still scores. Never leave a PBQ completely blank because you ran out of time.

The Five-Pass PBQ Method

Pass What to do Why it works

1. Task Read the exact verb: identify, configure, match, order, or remediate Stops you answering a different question than asked

2. Scope Mark the systems, users, ports, data, and constraints that matter Keeps you off distractors

3. Baseline Note what is already correct and what is clearly wrong Avoids unnecessary edits that break partial credit

4. Apply Make the smallest change set that reaches the secure end state Matches least privilege, limits side effects

5. Verify Re-read the task and check each required item Catches reversed direction, wrong source, or role errors

Read the Verb

The prompt verb tells you the scope of action. Over-acting is a common point-loser.

• Verb in prompt Correct behavior
• Identify Select the object or finding; do not redesign
• Configure Change settings, rules, roles, or controls to meet the goal
• Match Pair each item with the best category, control, or remediation
• Order Put actions into a defensible sequence
• Remediate Choose controls that address the stated root cause
• Recommend Pick the best fit under the stated constraints
• Worked Scenario: Branch Office Exposure

A branch office has a file server, a jump box, a web server, and a firewall. The prompt: "Configure the firewall to allow public HTTPS to the web server, allow administrators to manage internal servers only through the jump box, and block direct Internet management."

• Requirement Secure interpretation
• Public HTTPS to web server Allow inbound TCP 443 from Internet to the web server only
• Manage servers via jump box Allow admin subnet to jump box; allow jump box to internal management ports

Block direct Internet management Deny inbound SSH (22), RDP (3389), Telnet (23), WinRM (5985/5986) from Internet

Internal file server Do not expose SMB (445) to the Internet

Good PBQ thinking is not "open whatever might help." It is "open the exact business path and deny the risky shortcuts."

Final Check Before You Submit

Run this checklist on every configuration PBQ:

Direction: inbound vs outbound, and the source/destination pair, are correct.

Identity: the user, group, role, or service account holds only the access required.

Protocol: the secure option (HTTPS, SSH, LDAPS) is chosen when a secure and insecure pair both appear.

Order: the implicit deny-all rule sits last, and specific allows precede broad denies.

Evidence: logs, alerts, or tickets are preserved if the scenario is an investigation.

Constraints: legacy systems, downtime windows, cost, and compliance language are respected.

Common Exam-Day Mistakes

• Mistake Better move
• Solving from memory before reading the task Read the required end state first
• Writing permissive any-any allow rules Apply least privilege; specific source and destination
• Ignoring "most likely" or "best next" wording Choose the answer that fits timing and evidence
• Treating every log line as equal Prioritize correlated identity, endpoint, network, and time clues
• Leaving a flagged PBQ blank Bank partial credit; never submit empty

The difference between a 740 and a 760 is often one well-managed PBQ. Treat the workflow as a habit, not a luxury.