Trifectapp · original learning companion · version 1

PBQ reasoning workbook — exercises

Write your decision and evidence in review-journal.csv before opening the worked solutions.

Practice example 1: order a firewall rule set

Scenario: A training company hosts an internal web application at 10.20.20.20. Staff use 10.20.10.0/24; guests use 10.20.30.0/24. The administrator’s workstation is 10.20.99.10. All addresses are private examples for this exercise.

The firewall checks rules from top to bottom and stops at the first match. Evaluate only new inbound TCP connections to the application server; established return traffic is already handled. Staff require HTTPS on port 443. Only the administrator requires SSH on port 22. Everything else must be denied.

Your task: Select the necessary rules, place them in order and predict the outcome for staff HTTPS, guest HTTPS, administrator SSH and staff SSH.

Practice example 2: correct excessive permissions

Scenario: An invoice application combines permissions from all assigned roles. There are no inherited roles, direct grants or explicit deny rules. Company policy says the same person must not both edit and approve invoices.

Maya prepares invoices and currently has InvoiceEditor. Leo approves them and currently has both InvoiceApprover and InvoiceEditor. An external auditor needs read-only access until 17:00 UTC on November 20, 2026, and currently has no role.

Your task: Give each person the smallest role assignment that meets their work requirements. Identify one temporary-access control and two tests that would expose a permissions mistake.

Practice example 3: build a timeline from synthetic logs

Scenario: The following invented records use UTC. The account riley normally accesses the invoice application from a managed workstation. There is no approved role-change ticket. The external addresses are documentation examples.

09:10:00 AUTH user=riley source=198.51.100.77 result=fail
09:10:04 AUTH user=riley source=198.51.100.77 result=fail
09:10:09 AUTH user=riley source=198.51.100.77 result=success session=S17
09:10:10 MFA  session=S17 result=not_required policy=legacy_exception
09:11:02 APP  session=S17 action=add_role role=InvoiceApprover result=success
09:12:15 APP  session=S17 action=export records=2400 result=success

Your task: Identify the session that deserves investigation, summarize its sequence in one sentence and name two additional evidence sources. State one conclusion these logs do not establish.

Practice example 4: prioritize three security events

Scenario: You are the first available analyst. The response playbook allows immediate network isolation of ordinary employee endpoints using EDR while preserving the management channel. None of the affected devices supports a safety-critical process.

Your task: Choose the first event to address, the first containment action and the next investigation priority. Explain why a vulnerability severity label alone does not settle the order.

Practice example 5: validate a security change

Scenario: A team deploys a security update to an internal application during an approved window. The change plan authorizes restoring the previous application release if two consecutive checkout health checks fail. A tested rollback package is available; the update does not change the database schema.

Your task: Decide whether to close the change as successful. Select the next action and list what you would verify afterward.

Original Trifectapp practice, not official CompTIA exam questions. This workbook does not predict an exam score. Source: the published guide. Companion prepared November 7, 2026. The saved exercises retain the guide’s existing objective labels; this companion does not independently certify exam coverage.