In this guide: what a PBQ is · formats · which objectives they come from · timing · exam-day strategy · Security+ PBQ examples · Linux+ PBQ examples · how to practice
What is a PBQ?
A PBQ, or performance-based question, asks you to do something instead of picking a letter. You might put the steps of a process in order, drag items into the right category, finish a configuration or type commands into a terminal.
The official objectives for Security+ SY0-801 and Linux+ XK0-006 say the same thing in their test details: a maximum of 90 questions in 90 minutes, of two types, multiple-choice and performance-based. CompTIA does not publish how many PBQs each exam has or a fixed list of formats, so the safe approach is to be ready for all of the ones described below.
PBQs are not harder because the content is more advanced. They are harder because you cannot guess your way through them. On a multiple-choice question you can rule out two silly options and choose between the remaining two; on a PBQ you need to know the whole procedure.
Common PBQ formats
| Format | What you do | What it tests |
|---|---|---|
| Ordering | Put the steps of a process in sequence | Knowing what comes first and what comes next, not just what the steps are |
| Matching | Pair each concept with its definition, purpose or example | Telling similar terms apart |
| Drag into categories | Sort several items into two or more groups | Applying a rule to concrete cases |
| Simulation | Complete a configuration in an interface that mimics a device or system | Knowing which setting meets the stated requirement |
| Terminal | Type commands at a console until the system is in the required state | Commands, their options and their order |
On Security+, expect mostly ordering, matching, categorizing and simulations. On Linux+, the terminal carries more weight, because almost every objective is something you do with commands.
Which objectives PBQs tend to come from
Every CompTIA objective starts with a verb, and the verb tells you what kind of question to expect. Objectives that start with Explain, Summarize or Describe test understanding. Objectives that start with Given a scenario test application, and those are the natural candidates for a PBQ.
- Security+ SY0-801: 9 of the 27 objectives start that way, including change management (1.2), indicators of malicious activity (2.5), network security architecture (3.2), mitigating controls (4.1), vulnerability management (4.3), identity and access management (4.5), automation (4.6) and investigations (4.8).
- Linux+ XK0-006: 18 of the 29 objectives start that way: storage, networking, shell operations, backups, files, accounts, processes, software, systemd, containers, firewalls, hardening, scripting, Git and all four troubleshooting objectives.
Use that list to decide what you practice hands-on rather than just read about.
How much time to give a PBQ
Up to 90 questions in 90 minutes works out to about a minute per question. A PBQ usually takes several times that: you read a scenario, figure out the requirement and complete several pieces. Ten minutes sunk into one PBQ is ten minutes taken from questions you could have answered correctly.
Set a personal time cap for each PBQ on your first pass, before exam day. If you hit the cap and still are not sure, flag it and move on. Once the multiple-choice questions are done, come back with whatever time is left and without the pressure of unanswered questions behind you.
Exam-day PBQ strategy
- You do not have to answer in order. If the PBQs show up at the start, as they often do, you can flag them and keep going.
- Knock out the ones you know and flag the rest for the end.
- Read the requirement twice. Simulations hide details that change the answer: "only from the management network", "without unmounting the filesystem", "keep the user's home directory".
- Never leave one blank. If time is running out, fill in what you know; a partial answer beats an empty one.
- Do not second-guess out of nerves. Change an answer only if rereading turned up something you missed.
Security+ PBQ examples
These examples are original, written from the public objectives. They are not real exam questions, which are confidential.
Order the incident response stages
You get six shuffled cards: preparation, identification, investigation, containment, eradication and recovery, and post-incident activities. Put them in sequence. The usual trap is placing containment before investigation: in SY0-801 you scope the incident and preserve evidence first, then isolate. This comes from objective 4.7, which in V8 also adds stages such as negotiation and external notification.
Classify controls by type
Eight controls, four columns: preventive, detective, corrective and deterrent. A firewall rule blocking remote desktop from the internet is preventive; an IDS alert is detective; restoring a database from a clean backup is corrective; a legal warning banner at login is deterrent. The verb gives it away: block, alert, restore, warn. This comes from objective 1.1.
Finish a firewall rule set
A diagram shows the internet, a zone with a web server and the internal network, plus a half-filled rule table. The requirement: allow HTTPS from the internet to the web server, allow SSH to that server only from the management network, and block everything else. What is graded is the detail: the right port, the right source on the SSH rule and a final rule that denies the rest. It combines device placement and security zones (3.2) with rule-based firewalls (4.1).
Match indicators to what is happening
On the left, indicators: a user signing in from two countries minutes apart, many accounts locked out at once, an unknown process eating the CPU, access logs with gaps. On the right, what they most likely mean: stolen credentials, a brute-force attack, malware and an attempt to cover tracks. This comes from objective 2.5, which lists impossible travel, account lockout, brute force, excessive resource consumption and log manipulation.
Linux+ PBQ examples
Terminal: grow a volume without downtime
An application's filesystem is nearly full, the volume group has free space and the application cannot be stopped. Extend the logical volume with lvextend and grow the XFS filesystem with xfs_growfs, without unmounting it. What is graded is the end state: df -h must show the new size. This comes from storage management in domain 1.
Terminal: a service that will not start
A service fails at startup. Read the error with systemctl status and journalctl, fix the wrong line in the unit, reload systemd with daemon-reload, and leave the service running and enabled for the next boot. Plenty of people forget that last step: the service works now but does not survive a reboot.
Order the boot process
Shuffled cards: firmware (BIOS or UEFI), bootloader (GRUB), the kernel with its initrd, systemd and the final target. If you know where each piece loads, you also know where to look when boot fails, which is exactly what domain 5 asks.
Match configuration files
On the left, /etc/fstab, /etc/hosts, /etc/resolv.conf and /etc/sudoers. On the right, their purpose: filesystems mounted at boot, local name resolution without DNS, the system's DNS servers and who may use sudo. Easy, until there are six files and six similar-sounding purposes.
How to practice PBQs
- Practice the procedure, not the answer. For each Given a scenario objective, write the steps on cards and put them in order from memory.
- Use a terminal every day if you are preparing for Linux+. Commands stick by typing them, and a self-checking lab tells you whether the system ended up in the required state.
- Take full timed exams and measure how long the PBQs take you. If they run past your cap, drill those formats separately.
- Read the explanation even when you got it right. A right answer for the wrong reason will not hold up on exam day.
The HacksinCodigos practice exams include terminal PBQs plus ordering, matching and classification tasks, with the real exam's format and a 100–900 score. The free SY0-801 practice test includes a terminal PBQ and interactive questions, and the free XK0-006 practice exam includes a terminal PBQ. The exams are in English, like the real ones; the courses themselves are taught in Spanish.
For everything else on the exams, see the guides to Security+ SY0-801 and Linux+ XK0-006, with their domains and study plans.