Security+ Performance-Based Questions (PBQs): What They Are and How to Prepare
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Security+ includes performance-based questions, or PBQs, which ask you to complete a task in a simulated environment instead of choosing an answer. CompTIA says they usually appear at the start of the exam and that no clock is visible while you work on them. This guide explains what PBQs are, what CompTIA does and does not say about them, and how to practice. The strategies listed are common approaches among candidates and not CompTIA rules, so check the exam interface tutorial at your appointment.
What Performance-Based Questions Are
Performance-based questions, or PBQs, ask you to complete a task in a simulated environment instead of choosing from a list of answers. Typical tasks include matching controls to scenarios, ordering steps in a process, or configuring settings. CompTIA says Security+ includes them alongside multiple-choice questions, within the maximum of 90 questions in 90 minutes.
What CompTIA Says About Them
According to CompTIA, performance-based questions usually appear at the start of the exam, and no clock is visible while you are working on them. That second point matters for pacing, because it is easy to spend too long on a task without noticing.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Strategies Many Candidates Use
These are common approaches, not CompTIA rules. Check the exam interface tutorial at your appointment for how your version handles skipping and reviewing.
Look at the whole task before you start
Read the scenario and what is asked, so you know the end result before you click anything.
Watch the time
Because no clock is visible during these questions, decide in advance how long you will give a task, and consider moving on and returning if the interface allows.
Do the parts you know first
Complete the steps you are sure about, then reason about the rest, rather than leaving the whole task blank.
Check the interface rules at the start
Confirm whether you can flag a question and come back to it, since that changes your pacing strategy.
How to Practice for Them
PBQs reward understanding over memorization, because you apply a concept to a scenario.
Practice matching and ordering
Write out matching exercises, such as controls to categories or attacks to defenses, and ordering exercises, such as the stages of incident response.
Use hands-on labs
Configure a firewall rule, set file permissions or read a log in a free lab, so the tasks feel familiar.
Time yourself
Practice completing a task in a few minutes so you build a sense of how long a PBQ should take.
Review the objectives that say given a scenario
Objectives that start with that phrase are the ones most likely to be tested through scenarios and tasks.
What PBQs Do Not Change
PBQs do not change the passing score of 750 on a scale of 100 to 900, and CompTIA does not publish how they are weighted. Prepare for them as seriously as the multiple-choice items. For the full picture, see how Security+ is scored, our study plan and the objectives explained.
The bottom line
Treat PBQs as scenario tasks: read the whole task first, watch the time since no clock shows, and practice matching, ordering and configuring. CompTIA does not publish their weighting, so prepare for them as seriously as the multiple-choice questions.
Frequently asked questions
What are performance-based questions on Security+?
Performance-based questions ask you to complete a task in a simulated environment, such as matching, ordering or configuring, instead of picking from answer options. CompTIA says Security+ includes them alongside multiple-choice questions.
When do PBQs appear on the Security+ exam?
CompTIA says performance-based questions usually appear at the start of the exam, and that no clock is visible while you work on them, so plan your pacing before you begin.
How many PBQs are on Security+?
CompTIA does not state an exact number of performance-based questions in the sources we checked. The exam has a maximum of 90 questions in total, a mix of multiple-choice and performance-based.
Can I skip PBQs and come back to them?
Many candidates do, but CompTIA's pages we checked do not state the rule in full. Check the exam interface tutorial at the start of your appointment to see how flagging and returning to questions works.
Are PBQs worth more than multiple-choice questions?
CompTIA does not publish how performance-based questions are weighted. Prepare for them as seriously as multiple-choice items, and aim to be solid across every domain.
How do I practice for performance-based questions?
Practice matching and ordering exercises, use hands-on labs for tasks like firewall rules and permissions, and time yourself. Focus on the objectives that begin with given a scenario, since they are the best fit for task-style questions.
Do PBQs change the passing score?
No. The passing score is 750 on a scale of 100 to 900, the same for the whole exam. CompTIA does not describe a separate passing score for performance-based questions.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.
