CompTIA Security+ SY0-801 PBQ Practice: 5 Free Examples

Published by Trifectapp · Exam and technical sources checked 7 November 2026 · Interactive practice updated 9 November 2026

Try five free CompTIA Security+ SY0-801 PBQ practice examples with answers and worked explanations. Build a firewall policy, correct permissions, investigate logs, prioritize incidents and validate a change. Choose your decisions on this page, check the feedback and explain why your choices fit the evidence. No account is required.

Every scenario below is original Trifectapp practice with invented organizations, accounts and data. These are simplified learning exercises, not actual CompTIA exam questions, recalled items or predictions of the tasks you will receive.

Exam and source basis: CompTIA Security+ V8, SY0-801, CompTIA exam objectives, document version 2.0. Sources checked 7 November 2026. The five scenarios, worked answers and preparation suggestions are Trifectapp teaching material. Objective mappings identify related study coverage; they do not establish which tasks will appear in an exam.

What are CompTIA Security+ SY0-801 PBQs?

A performance-based question (PBQ) asks you to apply knowledge to a task or problem. CompTIA’s SY0-801 objectives, document version 2.0, page 3 list both multiple-choice and performance-based questions, with up to 90 questions and a 90-minute exam. The document does not assign a PBQ count or scoring weight to these practice topics.

Read the directions shown with each exam item. Interface controls, available actions and navigation instructions matter; a technique from a practice website is not a guarantee about your testing interface.

The exercises below relate to V8 objectives 4.1 (security controls), 4.5 (identity and access), 4.8 (investigation evidence), 4.7 (incident response) and 1.2 (change management). This is a learning map to the SY0-801 exam objectives, not an official PBQ blueprint.

Start the five free PBQ exercises

Read each scenario, make your selections and use its check button. Feedback evaluates the listed decisions; your written reasoning is for self-review against the worked explanation. These are simplified training activities, not a recreation of CompTIA’s exam interface or scoring.

Allow about 5–10 minutes per exercise as a suggested study pace. Your choices and notes remain in this page only; they are not submitted or saved when you leave or reload.

With JavaScript unavailable, use the same scenarios and controls to plan your answer, then open each worked explanation to review it manually.

Practice example 1: order a firewall rule set

Scenario: A training company hosts an internal web application at 10.20.20.20. Staff use 10.20.10.0/24; guests use 10.20.30.0/24. The administrator’s workstation is 10.20.99.10. All addresses are private examples for this exercise.

The firewall checks rules from top to bottom and stops at the first match. Evaluate only new inbound TCP connections to the application server; established return traffic is already handled. Staff require HTTPS on port 443. Only the administrator requires SSH on port 22. Everything else must be denied. For a reference on service defaults and transports, use the CompTIA Security+ SY0-801 ports and protocols guide.

Your task: Select the necessary rules, place them in order and predict the outcome for staff HTTPS, guest HTTPS, administrator SSH and staff SSH.

Build and check the firewall policy

Use three rules. Leave out the rule that grants unnecessary access, then predict each connection result under your intended policy.

Position 1Choose an answerA — Deny allB — Allow staff HTTPSC — Allow administrator SSHD — Allow HTTPS from any source

Position 2Choose an answerA — Deny allB — Allow staff HTTPSC — Allow administrator SSHD — Allow HTTPS from any source

Position 3Choose an answerA — Deny allB — Allow staff HTTPSC — Allow administrator SSHD — Allow HTTPS from any source

Staff HTTPSChoose an answerAllowDeny

Guest HTTPSChoose an answerAllowDeny

Administrator SSHChoose an answerAllowDeny

Staff SSHChoose an answerAllowDeny

Show the worked explanation for PBQ 1

Use B, C, A. C, B, A also works because the two allow rules do not overlap. Remove D: it would permit guests and every other source to reach HTTPS.

Staff HTTPS matches B and is allowed. Administrator SSH matches C and is allowed. Guest HTTPS and staff SSH reach A and are denied. Putting A first would block every request before an allow rule could be considered.

Notice the two kinds of verification: required traffic succeeds, and prohibited traffic fails. Testing only the staff website connection would miss an overly broad rule. Write both positive and negative tests whenever you practice access controls.

Practice example 2: correct excessive permissions

Scenario: An invoice application combines permissions from all assigned roles. There are no inherited roles, direct grants or explicit deny rules. Company policy says the same person must not both edit and approve invoices.

Maya prepares invoices and currently has InvoiceEditor. Leo approves them and currently has both InvoiceApprover and InvoiceEditor. An external auditor needs read-only access until 17:00 UTC on November 20, 2026, and currently has no role.

Your task: Give each person the smallest role assignment that meets their work requirements. Identify one temporary-access control and two tests that would expose a permissions mistake.

Build the least-privilege role assignments

Select the final effective role set for each person. Include every role you intend to retain.

Maya — prepares invoices

InvoiceEditorInvoiceApproverInvoiceReader

Leo — approves invoices

InvoiceEditorInvoiceApproverInvoiceReader

Auditor — reads records temporarily

InvoiceEditorInvoiceApproverInvoiceReader

Auditor access expiryChoose an answerReview it at the next monthly access meetingExpire at 17:00 UTC on November 20, 2026Keep it permanently because it is read-only

Write two tests that could expose a permission mistake (optional; compare with the explanation)

Show the worked explanation for PBQ 2

Keep Maya as InvoiceEditor. Keep Leo as InvoiceApprover and remove InvoiceEditor. Assign InvoiceReader to the auditor and configure the temporary assignment to expire at the specified time.

Verify that Maya can create an invoice but cannot approve it. Verify that Leo can approve an invoice but cannot change its contents. Also test that the auditor can read records but cannot edit or approve them. Confirm the expiry configuration and verify that access ends afterward; in a lab, use a short test interval.

Adding a read-only role to Leo would not cancel his existing edit permission. Under this scenario’s additive model, the excessive grant must be removed. On real platforms, inspect effective access because group nesting, direct grants and deny behavior can change the result.

Technical reference: NIST SP 800-53 Rev. 5, controls AC-5 and AC-6, provide background on separation of duties and least privilege. The additive-role behavior is an explicit assumption of this fictional application.

Practice example 3: build a timeline from synthetic logs

Scenario: The following invented records use UTC. The account riley normally accesses the invoice application from a managed workstation. There is no approved role-change ticket. The external addresses are documentation examples.

09:10:00 AUTH user=riley source=198.51.100.77 result=fail
09:10:04 AUTH user=riley source=198.51.100.77 result=fail
09:10:09 AUTH user=riley source=198.51.100.77 result=success session=S17
09:10:10 MFA  session=S17 result=not_required policy=legacy_exception
09:11:02 APP  session=S17 action=add_role role=InvoiceApprover result=success
09:12:15 APP  session=S17 action=export records=2400 result=success

Your task: Identify the session that deserves investigation, summarize its sequence in one sentence and name two additional evidence sources. State one conclusion these logs do not establish.

Reconstruct and check the evidence timeline

Session identifier to investigate

Timeline step 1Choose an answerRepeated failed loginsSuccessful loginMFA not required by the exception policyInvoiceApprover role added2,400 records exported

Timeline step 2Choose an answerRepeated failed loginsSuccessful loginMFA not required by the exception policyInvoiceApprover role added2,400 records exported

Timeline step 3Choose an answerRepeated failed loginsSuccessful loginMFA not required by the exception policyInvoiceApprover role added2,400 records exported

Timeline step 4Choose an answerRepeated failed loginsSuccessful loginMFA not required by the exception policyInvoiceApprover role added2,400 records exported

Timeline step 5Choose an answerRepeated failed loginsSuccessful loginMFA not required by the exception policyInvoiceApprover role added2,400 records exported

Select at least two useful additional evidence sources

Identity-provider sign-in and exception-policy recordsApplication audit, authorization and export contextManaged-device telemetryUser confirmation through a trusted channel

Which conclusion is supported?Choose an answerThe logs establish the identity of a human attackerThe logs prove an attacker defeated an MFA challengeThe logs establish the final destination of exported dataNone of those three conclusions is established

Summarize the observed sequence in one sentence (optional; compare with the explanation)

Show the worked explanation for PBQ 3

S17 warrants investigation: repeated authentication failures were followed by a successful login without an MFA requirement, a role addition and a large export.

Review identity-provider records for the account and exception policy, then application audit records for the role change, export destination and authorization context. Device records or confirmation from the user through a trusted channel could add context.

The log states that MFA was not required; it does not show an attacker defeating an MFA challenge. It also does not identify a human attacker or prove where exported data ultimately went. Treat the sequence as suspected account misuse requiring investigation under the response procedure.

A good answer separates observations from hypotheses. Preserve the original records, timestamps and session identifiers so another analyst can reproduce the sequence. Avoid replacing the evidence with a vague note such as “suspicious login.”

Technical reference: NIST SP 800-61 Rev. 3 (April 2025), RS.AN-03, RS.AN-06 and RS.AN-07, supports reconstructing events and retaining investigation records.

Practice example 4: prioritize three security events

Scenario: You are the first available analyst. The response playbook allows immediate network isolation of ordinary employee endpoints using EDR while preserving the management channel. None of the affected devices supports a safety-critical process.

Your task: Choose the first event to address, the first containment action and the next investigation priority. Explain why a vulnerability severity label alone does not settle the order.

Set and justify the response priorities

Priority 1Choose an answerA — Active ransomware encryptionB — Phishing quarantined before deliveryC — Critical exposed VPN vulnerability

Priority 2Choose an answerA — Active ransomware encryptionB — Phishing quarantined before deliveryC — Critical exposed VPN vulnerability

Priority 3Choose an answerA — Active ransomware encryptionB — Phishing quarantined before deliveryC — Critical exposed VPN vulnerability

First containment actionChoose an answerDelay isolation until a full disk image is completeImmediately wipe the laptopUse the authorized EDR isolation and preserve management access

Why this priority?Choose an answerA severity label alone determines every incident priorityActive harm, exposure, impact and authority guide this decisionNo exploitation evidence means the VPN can be ignored

Name the evidence that would make you change this priority (optional; compare with the explanation)

Show the worked explanation for PBQ 4

Address A first. Use the authorized EDR isolation action to limit continued spread, notify the incident lead and assess affected shared resources. Network isolation may not stop encryption already running locally, so follow the playbook for further containment and eradication. Preserve evidence and document the action; wiping the laptop immediately would make investigation harder.

Escalate C next for urgent exposure assessment and mitigation planning with the VPN owner. Investigate scope, vendor guidance and available protections rather than treating “no evidence” as proof that exploitation has not occurred. Review B to confirm the quarantine and look for related messages.

The proposed order is A, C, B because of the specific evidence and impact here. It is not a universal ranking for every incident. A critical vulnerability on a different asset, evidence of exploitation or a safety dependency could change the decision.

Technical reference: NIST SP 800-61 Rev. 3, RS.MA-03 and RS.MI-01, discusses incident prioritization and containment. The A–C–B order is Trifectapp’s reasoning under the stated playbook and asset assumptions.

Practice example 5: validate a security change

Scenario: A team deploys a security update to an internal application during an approved window. The change plan authorizes restoring the previous application release if two consecutive checkout health checks fail. A tested rollback package is available; the update does not change the database schema.

Your task: Decide whether to close the change as successful. Select the next action and list what you would verify afterward.

Check the rollback and verification decision

Close the change as successful?Choose an answerYes — three of four checks passedNo — a required acceptance check failed

Next authorized actionChoose an answerKeep retrying checkout indefinitelyRecord evidence, notify the owner and run the approved rollbackClose the change and investigate next week

Acceptance checks to repeat after restoration

HTTPS returns the expected pageA standard user completes a test checkoutA standard user is denied the administration pageRequired audit events reach monitoring

How should the restored release be treated?Choose an answerThe underlying security issue is permanently resolvedRecord its prior risk and plan a corrected deploymentIgnore prior risk because availability is restored

Record the release version and evidence you would retain (optional; compare with the explanation)

Show the worked explanation for PBQ 5

Do not close the change as successful. The defined rollback condition has been met. Record the failed checks and relevant error evidence, notify the change owner and execute the approved restoration procedure within its authorization.

Afterward, repeat all acceptance checks: expected page, checkout, access restriction and audit delivery. Confirm the restored release and document the service status. Successful HTTPS connectivity alone does not prove that the application works.

Restoring the previous version also restores its prior security risk. Record that risk, maintain any approved compensating controls and plan a corrected deployment. Rollback is a controlled recovery step, not a permanent substitute for remediation.

Technical reference: NIST SP 800-53 Rev. 5, CM-3, covers controlled, documented and reviewed configuration changes. The two-failure rollback trigger belongs to this scenario’s approved plan.

Download the PBQ reasoning workbook

Save your own decisions before opening the worked explanations. The downloadable workbook contains all five original scenarios, a separate solution reference and a five-row reasoning journal.

Download the PBQ reasoning workbook (ZIP)

Inside: Five printable scenarios; five worked explanations; editable reasoning journal; one labeled worked journal example.

1. Open exercises.html and attempt one scenario without the solution reference.
2. In review-journal.csv, record your decision, the scenario evidence and a test that could expose a mistake.
3. Compare worked-solutions.html, correct the reasoning and choose one follow-up exercise.

Example	Evidence to record	Follow-up reasoning
Firewall rule order	Guest HTTPS reaches the final deny rule.	Test both required staff access and prohibited guest access.

The example is a learning note, not a record of a real learner. Use the journal for your own reasoning; it does not calculate exam readiness. Extract the ZIP, open the HTML files in a browser and edit the CSV in a spreadsheet or text editor. Print from your browser if useful. No account or connection is needed to read the extracted workbook.

How to prepare for CompTIA Security+ SY0-801 PBQs

For each exercise, write down the required outcome, the restrictions and the evidence you will use to check your answer. Then make the smallest justified change. This reduces the temptation to change every available setting when only one problem needs correction.

Repeat a scenario with one detail changed. Move the administrator to another subnet, remove an approved maintenance window or change a user’s job responsibilities. Explain which part of your answer changes and which part stays the same.

Use our CompTIA Security+ SY0-801 lab guide to turn written decisions into hands-on activities. Add these sessions to the eight-week study plan, then use free CompTIA Security+ SY0-801 practice questions to check conceptual gaps. The CompTIA Security+ course curriculum shows the available preparation resources.

Frequently asked questions

How many PBQs will I receive on SY0-801?

The official objectives cited here do not specify a fixed number. Prepare for the skills across the blueprint rather than planning around an unofficial count.

Are these the PBQs from the actual exam?

No. They are original practice exercises designed to develop reasoning and verification habits. Their format, complexity and subject selection do not predict an exam session.

Should I skip every PBQ immediately?

Use the instructions and navigation options provided in your exam. During practice, measure how long tasks take and build a realistic time plan without assuming every interface allows the same actions.

Does completing these five examples mean I am ready?

They cover a small set of skills. Review the full objectives, practice unfamiliar tasks and check that you can explain your decisions using new examples.

Sources and teaching notes

The exam specification comes from CompTIA. The NIST references explain technical principles; they are not an official answer key or an additional SY0-801 requirement. The cited SP 800-53 base document is Revision 5, updated December 2020; its publication page also links later control-catalog releases.

• CompTIA Security+ SY0-801 V8 objectives, document version 2.0