CompTIA Security+ · 考试领域

General Security Concepts：Security+ 考察什么，如何备考

这是词汇基础域,定义了控制类型、安全原则和变更管理理念,其他四个域都假定你已经掌握这些内容——这也是为什么这部分基础薄弱往往会拖累整体成绩的原因。

免费练习这个领域 Security+ 概览
范围

这个领域涵盖的内容

下面的列表遵循 SY0-701 官方公布的考试大纲。这里深度比广度更重要：考试要求你把这些概念应用到具体场景中，而不是背诵它们。

  • 控制类别——技术性、管理性、操作性、物理性——以及控制类型,如预防性、检测性、纠正性和补偿性控制。
  • CIA三元组(机密性、完整性、可用性)、不可否认性、身份认证、授权与审计,以及差距分析。
  • 零信任作为一种模型:控制平面与数据平面、策略引擎、策略管理器与策略执行点。
  • 物理安全措施以及诱骗技术,如蜜罐(honeypot)和蜜标(honeytoken)。
  • 作为安全流程的变更管理,以及密码学基础构件:PKI、加密级别、密钥交换、哈希、数字签名和证书。
常见错误

考生容易失分的地方

  • 混淆控制类别与控制类型。题目往往同时问这两者,而一台防火墙可以同时是技术性和预防性的——考试要求你把这两个维度分开考虑。
  • 把补偿性控制当作"备用方案"的同义词。补偿性控制的存在是因为主要控制不可行,考试直接考察这一区别。
  • 死记硬背零信任的各个组件,却分不清哪个负责决策、哪个负责执行。

尽管这个域看起来最简单,也要最先学习它。安全运营和安全架构中的每一个场景题都建立在这些词汇之上,如果在这里草草带过,后面会反复吃亏。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. Create a free account to save your progress. No card required.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

看看这是不是你的薄弱领域

20 道免费 Security+ 题目，无需信用卡。准备度按领域呈现，这样你就能看出 General Security Concepts 是不是复习该重点关注的地方。

免费开始

Security+ 的其他领域