Performance-based question practice tasks
A performance-based question (PBQ) asks you to do a small task in a simulated interface instead of picking a lettered option: order rules, read a log, drag items into place or fill in a setting. The decision rule is to treat each one as a short scenario with a checkable result: work out the answer on paper first, then make the interface match it. The four tasks below are original exercises written for practice, not copies or reconstructions of any real exam item, and each one trains a skill that PBQs commonly test.
Task 1: put four firewall rules in order
A firewall evaluates rules top to bottom and applies the first one that matches. The network team needs these four rules in a working order:
| Rule | Action | Source | Destination | Port |
|---|---|---|---|---|
| A | Permit | any | 10.0.10.20 | TCP 443 |
| B | Deny | 203.0.113.50 | any | any |
| C | Permit | 10.0.99.5 | 10.0.10.0/24 | TCP 22 |
| D | Deny | any | any | any |
Requirements: the public may reach the web server on HTTPS; the admin host 10.0.99.5 may use SSH to the server subnet; the known-bad host 203.0.113.50 must be blocked from everything; all other traffic is denied.
Answer: B, A, C, D (A and C may swap). To check, simulate five packets against that order: 203.0.113.50 to 10.0.10.20 on 443 is denied by B; 198.51.100.7 to 10.0.10.20 on 443 is permitted by A; 198.51.100.7 to 10.0.10.20 on 22 is denied by D; 10.0.99.5 to 10.0.10.30 on 22 is permitted by C; 10.0.99.5 to 10.0.20.5 on 22 is denied by D. Two wrong orders fail visibly. A first puts the bad host through on 443 because the permit matches before the block is reached. D first denies everything, including the traffic you meant to allow. The pattern: specific denies first, then the permits, then the final deny. Details of rule matching in Azure are in NSG rule evaluation, and the same logic applies to router ACLs.
Task 2: read an authentication log
09:14:01 Failed admin 198.51.100.23
09:14:03 Failed admin 198.51.100.23
09:14:04 Failed root 198.51.100.23
09:14:06 Failed admin 198.51.100.23
09:14:07 Failed admin 198.51.100.23
09:14:09 Failed admin 198.51.100.23
09:14:30 Failed jsmith 192.0.2.44
09:15:12 Accepted admin 198.51.100.23
09:41:55 Accepted jsmith 192.0.2.44
Which account is most likely compromised, what attack does the log show, and what do you do first?
Answer. Counting failures per source gives 6 from 198.51.100.23 within 8 seconds (across the admin and root accounts) and 1 from 192.0.2.44. Many fast failures from one address followed by a success for the same account is a password-guessing (brute force) pattern that ended in success, so admin is the likely compromised account. The single failure then success for jsmith is ordinary typing behaviour. First actions: contain (disable or lock the admin session and block the source address), then reset the credential and review what the session did. This follows the order in incident response lifecycle. Attack names are summarised in common attack types. Always compare timing, count, source and outcome; one signal alone proves little.
Task 3: pick the protocol and port
Match each requirement to the best choice: encrypted file transfer over SSH, directory queries protected by TLS, email submission from a client to a mail server, remote desktop to a Windows server, log forwarding from devices to a collector, name resolution.
Answer (ports as registered by IANA): SFTP uses TCP 22; LDAPS is TCP 636; mail submission is TCP 587; RDP is TCP 3389; syslog is UDP 514 in the classic setup; DNS is port 53 over UDP and TCP. When two answers look alike, ask whether the requirement says “encrypted” (22, 636, 587 with TLS) and which direction the traffic flows. The full list is in the common ports cheat sheet.
Task 4: match controls to scenarios
For each scenario give the control category (technical, managerial, operational, physical) and one control type (preventive, deterrent, detective, corrective, compensating, directive): (1) a badge reader on the server room door, (2) a security camera in the same room, (3) a written acceptable use policy, (4) an intrusion prevention system dropping a malicious packet.
Answer. (1) Physical, preventive. (2) Physical, detective (a visible camera can also deter). (3) Managerial, directive. (4) Technical, preventive. Several answers can be defensible, so PBQs of this type reward the most direct reading: what does the control do at the moment of the event? Categories and types are covered in the security control categories guide.
Which exams test this
PBQs are a question format, not an objective. The outlines name the format rather than a domain, so the table lists where each exam says it uses them.
| Exam | How the topic appears | Where on this site |
|---|---|---|
| SY0-801 | Exam details list multiple-choice and performance-based questions (up to 90 questions, 90 minutes). V8 launches Nov 17, 2026; SY0-701 until then | Exam format |
| N10-009 | Multiple-choice plus PBQs, up to 90 questions in 90 minutes; the task content comes from all five domains | Exam format |
| CY0-001 | Multiple-choice plus PBQs, up to 60 questions in 60 minutes | Exam format |
For other exam formats (drag-and-drop, case studies, labs), see certification exam question types.
How to work a simulation
Read the whole scenario and the requirement list before touching the interface. Decide the end state first, because the interface is only a way to enter it. Check one case at a time against your answer, as in Task 1. Watch constraint words: “least privilege” means the narrowest rule that works, “only” means everything else must be denied, “first” and “next” are about order. Time matters, so skip and return to a PBQ if it stalls you, as the exam-format guides above describe. The skill underneath is the same as in multiple-choice questions; see multiple-choice exam tips.
Question 1. A firewall rule list contains, in this order: permit TCP 443 from any to the web server; deny all traffic from 198.51.100.9; deny all other traffic. Traffic from 198.51.100.9 to the web server on TCP 443 is still reaching the server. What is the most direct fix?
- A. Delete the final deny-all rule
- B. Change the permit rule to UDP 443
- C. Move the deny for 198.51.100.9 above the permit rule
- D. Add another permit rule for TCP 443 at the bottom
Show answer
Answer: C
Rules are evaluated top to bottom and the first match wins, so the permit for TCP 443 matches before the specific deny is reached. Moving the deny for 198.51.100.9 above the permit fixes it. Deleting the final deny would open the firewall to unrelated traffic. Changing the permit to UDP would break HTTPS. Adding a second permit rule does nothing to a packet that already matched an earlier rule.
Question 2. A log shows 40 failed logins for one account from a single address in 30 seconds, then a successful login for that account from the same address. Which response comes first?
- A. Contain: terminate the session, block the source and reset the credential
- B. Wait to see whether more failed logins appear
- C. Delete the log entries to keep the log small
- D. Review the password-age policy next quarter
Show answer
Answer: A
Failures followed by success from one source indicate a likely successful password-guessing attack, so contain first: lock or disable the account session and block the source, then reset credentials and investigate. Waiting for more failures adds nothing. Deleting the log destroys evidence. A routine password-age policy review is useful later but does not address the active compromise.
Go deeper
- CompTIA Security+ certification page, the official exam details including the question types.
- IANA service name and port number registry, the source for the ports in Task 3.
- RFC 5424, The Syslog Protocol, the message format behind log collection.
- Related guides: security control categories, OSI vs TCP/IP, and how to study for certification exams.