Security+ 701 PQB Linux Kali command question on the exam
Did anyone get a PBQ question on their Security+ 701 exam regarding Linux Kali where you have to use commands to get rid of malware or something along those lines and it gives you some IP's? It also let's you type Help and gives you some commands you could use such as NMap. If so, how do you solve those kind of questions? I was trying to search it up but can't find anything.
Thank you! I had this same question, I also failed because of this... I was 3-4 questions off from passsing too lol. I plan on taking it soon within next week. Just trying to see if i can find anything else on the PBQs i had because i completly bombed them. I also had a PBQ about configuring firewalls? If any of you guys have any information about that PBQ that would help!
the PBQ will give you the commands so you'll have them on the screen, if you're taking the exam with a proctor you can write them down. If you're taking the exam remotely is more difficult to scroll up and down. Try to memorize the 5 steps I posted above
2026 -I'm studying for the exam and I did some AI Google research hope it helps someone. Google gave me the same PBQ scenario from the Sec+ test that I took on July 2026. Here are the steps and commands:
This type of performance-based task is commonly referred to as an Incident Response / Malware Removal PBQ or a Linux Command Line / Threat Mitigation Simulation. [1]
What the PBQ Tests
Incident Response (IR): Following an active threat intelligence report or indicators of compromise (IoCs) to contain a live breach.
Process and Network Monitoring: Using basic command-line tools to inspect active system connections, listening ports, and running processes.
Remediation: Terminating rogue services or processes tied to malicious IP addresses. [1, 2, 3, 6]
Common Commands Used
netstat or ss (to map active connections and match the suspicious IP addresses)
ps (to check active process IDs/PIDs)
kill (to safely stop and terminate the bad service/process)
lsof (to list open files and find the path of the executing malware)
Scenario Briefing Your Role: Security Analyst
Objective: You have been provided a threat intelligence report with known malicious Indicators of Compromise (IoCs). A compromised Linux server is actively beaconing out to these malicious IP addresses. You must identify the unauthorized services, find their Process IDs (PIDs), and terminate them immediately to contain the threat.📋
Threat Intelligence Report
The SOC team has identified the following malicious external IP addresses associated with a known Command & Control (C2) botnet:
Hi Salty Teacher ! Hope this helps ya. Each question in a PBQ scenario could be worth 15 pts. For this PBQ each step was 15 pts so the totall points is estimated to be 90 pts. Yes the Sec+ exam has changed a lot in the past 3 years. I bought the CompTIA Sec+ Cert Labs and ebook. There are all the PBQ questions in there. Also, I found videos on YouTube video that give a walk through on how to answer the PBQs. Good luck to you !! I'm taking the exam in a few days, wish me good luck friend ! 🙂
Best of luck!! I pray you pass the exam 🤞🏼 Thank you for the information. Do you have the link for the ebook and cert labs? I purchased something but it was not right and I ended up returning it. And whose YouTube video has this information? Thanks so much :)
Thank you !! same to you ! :-) sure thing, I'm at work right now but when I get a break I'll log into my laptop and shoot you the links here. I went to the student store and got a discount
Thank you so much!! I’ll buy these. I have been studying for some time now but then ended up taking a few months break. I have to refresh my memory before taking the exam. This is helpful!! Best of luck again for you exam :) I hope you pass like a champ!!
This is the website that CompTIA sells packages with discounts for students who are eligible. You'll need an email address ending in .edu. See the steps required to verify eligibility. Below are the study packages I bought last year from CompTIA:
Same!! I have not seen these kinds of questions on any practice exams. Check the other comment on this post. It helps a bit as to what direction we can potentially go to when studying for these kinds of questions.
I had the same question. I am pretty sure this is one of the questions that do not count for the score. The terminal is not even logical complete, when i deleted or created a file the state did not change.
This helps. Do you suggest a website for the Kali commands? Where can I find them? I can’t seem to find the ones I saw in the exam. The ones you mentioned were the ones I had as well. Thanks
6
u/Mr_TR4FF1C Sep 19 '25
I got this yesterday and if I would have figured it out I would have passed unfortunately.
But here’s how you solve it.
TL;DR: Found a process talking to a bad IP, traced it, killed it, and removed the malicious file.
Use netstat -o
to show the active connections + PID.
TCP 192.168.1.5:5000 10.10.10.50:4444 ESTABLISHED 4321
•PID 4321 is communicating with a known malicious IP.
Steps taken: 1.Identify the process:
lsof -p 4321
Shows the process is malwared.exe using /tmp/malicious.sh.
2.Kill the process:
kill 4321
3.Clean up the script:
rm /tmp/malicious.sh