Security+ PBQs are interactive exam tasks that ask you to apply security knowledge in a scenario. On the CompTIA Security+ exam, they may involve interpreting a log, matching controls to a scenario, or completing a configuration in a simulated environment instead of selecting one answer.
Think of PBQs as virtual labs. You might be asked to configure a firewall, set up a secure wireless network, or drag-and-drop steps of an incident response plan in the correct order. They test your ability to apply what you've learned, not just memorize definitions.
How Many PBQs to Expect?
The Security+ exam consists of a maximum of 90 questions, and you have 90 minutes to complete them.
⚠️ Important: PBQs almost always appear at the very beginning of the exam.
CompTIA does not publish a guaranteed PBQ count, order, or weighting. Plan for a mix of item types, budget time for interactive tasks, and use the exam interface's review tools when a scenario needs more thought.
How Are PBQs Scored?
CompTIA keeps the exact scoring algorithm confidential, but here is what we do know:
- Scoring details are not published: CompTIA does not disclose the scoring formula, individual item weights, or whether a particular PBQ offers partial credit.
- Focus on the requested outcome: Read every constraint, complete each required field, and review your work before moving on when time permits.
What Do Security+ PBQs Look Like?
1. Scenario-Based Networking Simulations
These are often considered the most challenging. You might be presented with a network diagram and tasked with securing it.
Task Example: "Configure the Access Control List (ACL) on the router to permit HTTP traffic to the Web Server in the DMZ but deny all other traffic from the internet."
2. Fill-In-The-Blank
These questions test your specific knowledge of configurations, ports, or command syntax.
In this example, you would need to know the specific requirements and features of RAID 10 (Minimum 4 drives, striping and mirroring supported, but no parity).
3. Drag-And-Drop
You will often see these for processes or matching terms. A common example is the Incident Response Lifecycle.
Task Example: "Drag the Incident Response steps from the left and place them in the correct order on the right."
Best Way to Approach PBQs
Flag for Later
Since PBQs are time-consuming and appear first, many successful candidates skip them initially. Use the "Mark for Review" feature, blast through the multiple-choice questions you know, and then come back to the PBQs with your remaining time.
Read Instructions Carefully
It sounds obvious, but PBQ instructions can be dense. Missed details (like "use the last usable IP address") are a common reason for failure.
Don't Panic on Reset
Most simulations have a "Reset" button. If you mess up a configuration, you can usually verify if you need to start fresh. Just be mindful of the clock.
Security+ PBQ Practice Checklist
PBQs reward practical pattern recognition. Before test day, make sure you can complete these tasks without needing to memorize a single screenshot.
Network security
- Place public services in a DMZ and keep internal hosts private.
- Choose allow/deny firewall rules using source, destination, protocol, and port.
- Recognize secure management protocols such as SSH, HTTPS, and SFTP.
Operations and response
- Order incident response steps from preparation through lessons learned.
- Read authentication, firewall, DNS, and endpoint log snippets.
- Match controls to scenarios: MFA, DLP, EDR, segmentation, backups, and encryption.
For a deeper walkthrough, pair this guide with our firewall, Wi-Fi, and log analysis PBQ examples, then test your knowledge in the Security+ practice quiz.
Frequently Asked Questions
Can I get partial credit on PBQs?
CompTIA does not publish which PBQs, if any, award partial credit. Complete every requested part of the task instead of relying on a scoring assumption.
Are PBQs harder than multiple choice?
Most students find them harder because they require active problem solving rather than recognition. They also carry a higher cognitive load due to the interface.
How much are PBQs weighted?
CompTIA does not publish PBQ weights. Treat them as important exam tasks and prepare to work through both multiple-choice and interactive items within the available time.