Most people studying for SY0-701 prepare for the firewall PBQ by memorizing port numbers. Then they get one and find the port numbers were handed to them in the requirements, and the thing being tested is something else.
Here is what actually gets graded.
The list is evaluated top to bottom, and it stops
A firewall rule set is not a set. It is an ordered list. The engine walks it from the top, and the first rule that matches the traffic is the one that runs. Nothing below that rule is consulted for that packet.
That one sentence produces most of the wrong answers on these questions. If you write a rule permitting HTTPS from the finance subnet, and three rows above it there is a rule denying everything from that subnet, your rule is correct and it will never execute. It is dead. The grader does not care that you knew 443.
So the working question when you place a rule is not "is this rule right", it is "does anything above this rule already match this traffic".
Specific goes above general
The practical version of the ordering rule: narrow rules on top, broad rules underneath.
If one requirement says block all traffic from the guest network and another says allow the guest network to reach the DNS server, those two conflict on purpose. The exam is checking whether you noticed. The allow has to sit above the deny, because it is the more specific of the two. Put the broad deny first and the exception you were asked for stops existing.
Any time two requirements touch the same source or destination, one of them is meant to be an exception to the other, and the exception goes higher.
There is already a deny at the bottom
Every firewall has an implicit deny as its final behavior. Traffic matching no rule is dropped. You do not have to write that.
People write it anyway, because a deny-all at the bottom feels like closing the door. It is harmless in production and it is a tell on the exam: it says you are treating a rule list like a checklist rather than an evaluation order. There is a practical cost too. If the interface gives you five rows and you spend one on a rule the engine already performs, you may not have room for a requirement you actually needed.
The exception is logging. An implicit deny is silent, so if the requirements ask you to log dropped traffic, an explicit deny at the bottom is doing real work. If they do not, leave the row empty.
Read the requirements as the answer key
The requirements list is not context. It is the marking scheme, written out.
Read all of it before you touch a field. Count the requirements. If there are four, you are looking for four rules, and if you have written six you have invented two. Then work them in the order the ordering rule demands rather than the order they are printed in, because they are almost never printed in the order they need to be applied.
The requirements also hand you the fields. "The web server must be reachable from the internet over an encrypted connection" gives you the destination, the port and the action. You are not recalling 443 from memory. You are reading the word encrypted and picking it off a dropdown.
Partial credit is real, so never leave a row empty
CompTIA says partial credit may be given on performance-based questions. A half-finished PBQ still scores. A blank one is a guaranteed zero, and a wrong answer and an empty box are worth exactly the same thing.
That makes the strategy obvious, and almost nobody follows it: fill every field, including the ones you are guessing on. Stuck between two source addresses? Pick one and move on. Then flag the question, bank the multiple choice, and come back if the clock allows.
One more timing note. PBQs usually load at the front of the exam. Up to 90 questions in 90 minutes means they can eat fifteen of your minutes before you have scored a single easy point, so skip them on the first pass if they are not coming quickly.
Try one
You can read all of this and still freeze the first time you see the interface, because the interface is the part nobody practices. I built a free configuration PBQ in the exam's style: four firewall requirements, graded with partial credit, feedback on every field, no account needed. It is at https://secplusmastery.com/security-plus-pbq
It is mine, so weigh that as you like. Professor Messer's free SY0-701 series and Jason Dion's practice exams are the two things I would put alongside it.
Top comments (0)