PracticePBQ.comFree Security+ PBQ practice

Free Security+ PBQ practice: hands-on labs

Performance-based questions are the part of the exam where you have to do something instead of picking A, B, C or D. These six labs let you practise that: write firewall rules, read an auth log, order an incident response, name attacks, match ports and set permissions. It’s free, you don’t need an account, and every mistake gets an explanation.

Try the first lab

The labs

Pick one. A box gets ticked when you pass, and it’s remembered in this browser.

Firewall rules: order matters

Set an action for each rule, then put the rules in the right order.

Ticket: A new web server 10.0.1.10 sits in the DMZ. Configure the perimeter firewall so that:

  1. The host 203.0.113.50 is blocked completely.
  2. Anyone on the internet can reach the web server over HTTPS.
  3. Only the admin PC 10.0.2.15 can reach the web server over SSH. Everyone else is denied SSH.
  4. Staff on 10.0.2.0/24 can browse HTTPS sites on the internet.

Everything else should be blocked.

#SourceDestinationServiceActionMove
lastAnyAnyAnyDeny (implicit)Locked

What the labs cover

Security+ PBQs keep testing the same handful of skills: reading and writing firewall rules and ACLs, spotting an attack in a log file, putting incident response steps in order, recognising common attacks, knowing which protocol runs on which port, and applying least privilege. Each lab here is built around one of those.

Security+ ports and protocols cheat sheet

Port questions turn up in PBQs and in the multiple-choice section. Learn the secure replacement next to each insecure protocol.

PortProtocolTransportEncrypted?
20/21FTPTCPNo. Use SFTP (22) or FTPS
22SSH, SFTPTCPYes
23TelnetTCPNo. Use SSH
25SMTPTCPNo. Server-to-server mail
53DNSUDP/TCPNo. DNSSEC adds integrity
67/68DHCPUDPNo
69TFTPUDPNo
80HTTPTCPNo. Use HTTPS
110POP3TCPNo. Use 995
143IMAPTCPNo. Use 993
161/162SNMPUDPv3 only
389LDAPTCP/UDPNo. Use LDAPS (636)
443HTTPSTCPYes (TLS)
445SMBTCPRestrict it
514SyslogUDPNo
3389RDPTCPRestrict it, put it behind a VPN

Incident response phases, in order

Preparation, detection and analysis, containment, eradication, recovery, lessons learned. When a question asks what to do first after an incident is confirmed, contain before you eradicate.

Questions about PBQs

What is a Security+ performance-based question?

It’s a hands-on task in the exam instead of a multiple-choice question. You might order firewall rules, read logs, match attacks to scenarios or assign permissions. You can’t get them right by recognising a term, you have to apply it.

Are there free Security+ PBQ practice labs?

Yes, these six. They cover firewall rules, log analysis, incident response, attack types, ports and protocols, and access control. No account, and each wrong answer comes with an explanation.

What do PBQs usually test?

Typical skills are firewall and ACL rules, reading logs, incident response steps, identifying attacks, choosing secure protocols and applying least privilege. Check the official exam objectives for the current list.

When do PBQs appear in the exam?

Usually at the start. You can flag one, do the multiple-choice questions, and come back. Counts and timing change, so check the exam provider’s current information.

How should I practise them?

Do a lab without notes, read the explanation for anything you missed, then redo it until you can say why each answer is right. Knowing the reasoning matters more than remembering one answer.

Are these real exam questions?

No. Every scenario was written from scratch to teach the skill. Nothing is copied from any exam.