Log analysis PBQs test your ability to identify security incidents in real-world log data. This guide teaches you the exact methodology to spot brute force attacks, privilege escalation, and indicators of compromise.
Interactive simulation — no account required
On the Security+ exam, a log analysis performance-based question presents you with a set of security logs and asks you to identify specific entries that indicate a security incident. Unlike multiple choice questions where you pick from options, you're analyzing raw data and making decisions like a real security analyst.
You'll typically see authentication logs (SSH, Windows Event Logs), firewall logs, web server logs, or system logs. The question might ask you to:
Log analysis PBQs appear on approximately 85% of Security+ exams and are worth 2-3x the points of standard multiple choice questions. Getting these right can be the difference between passing and failing.
When you see a log analysis PBQ, don't panic. Follow this systematic approach:
The Security+ exam tests your ability to recognize these specific patterns:
Rapid failed login attempts from a single source, often targeting root/admin accounts.
FAILED password for root from 203.0.113.45 (×50 in 30 seconds)Failed logins across multiple usernames from the same source.
FAILED: admin, administrator, root, user1, guest...User attempting commands or access beyond their permissions.
sudo: jsmith : command not allowed ; COMMAND=/bin/cat /etc/shadowSuccessful auth following multiple failures from the same IP.
FAILED ×47... then ACCEPTED password for root from 203.0.113.45Let's apply the 4-step method to a realistic example. Read through these logs and try to identify the security incident before reading the analysis:
Step 1 — What are we looking for? Signs of unauthorized access or a security incident.
Step 2 — Timestamps: Lines 3-6 all occur within 1 second (09:15:33-34). That's not a human typing passwords—it's automated.
Step 3 — Source IP: 203.0.113.45 is an external IP (not in any private range). It's targeting the root account specifically.
Step 4 — The success: At 09:18:12, the same external IP successfully authenticates as root. Then immediately accesses /etc/shadow (the password hash file).
Conclusion: This is a successful brute force attack. The attacker gained root access and is now extracting password hashes for offline cracking. The highlighted lines are your indicators of compromise.
Apply what you've learned with an interactive log analysis simulation.
On exam day, train yourself to look for these specific indicators:
A log analysis PBQ presents you with security logs (authentication logs, firewall logs, system logs) and asks you to identify security incidents, indicators of compromise, or policy violations. You must select the log entries that show evidence of attacks like brute force attempts, unauthorized access, or data exfiltration.
The Security+ SY0-701 exam typically has 4-5 performance-based questions out of 90 total questions. PBQs are worth more than standard multiple choice questions, often 2-3x the point value, making them critical for passing.
Many test-takers skip PBQs initially and return after completing multiple choice questions. This ensures you don't run out of time on easier questions. However, don't leave PBQs unanswered—their higher point value means they significantly impact your score.
Common log types include SSH/authentication logs, Windows Event Logs, firewall logs, web server access logs (Apache/Nginx), and system logs. You should be comfortable recognizing the format and key fields in each type.
Apply these concepts with an interactive Log Analysis simulation.