Performance-based questions (PBQs)
Why it matters: The real exam includes interactive tasks alongside multiple-choice questions. They're often worth more, and they take longer.
Overview
Supplementary — not from your PDFPBQs ask you to do something rather than pick an answer: match items, order steps, complete a configuration, or read a log or diagram. This app has no simulated PBQs yet, but the Practice Labs build the same skills with real tools.
Common PBQ styles
- Drag and drop: match controls to categories, attacks to indicators, or ports to protocols.
- Ordering: put incident response phases or the order of volatility in sequence.
- Configuration: complete firewall rules or wireless settings so they meet stated requirements.
- Analysis: read logs, a network diagram or a certificate and identify the issue.
Exam strategy
- PBQs usually come first. If one takes too long, flag it, move on, and come back after the multiple-choice questions.
- Read every requirement in the task. Rules often need both an allow and a deny in the right order.
- Answer every part. There's no penalty for a best attempt.
- Practise with the labs: firewall rules (host firewall lab), log reading (event log labs), classification (control inventory lab), and IR ordering (ransomware tabletop).