CompTIA Security+ · 考试领域

Security Operations：Security+ 考察什么，如何备考

这是考试中占比最大、也最偏操作性的域。它涵盖了保障一个企业环境日常安全工作的方方面面:加固、监控、漏洞管理、身份与访问管理、自动化和事件响应。

免费练习这个领域 Security+ 概览
范围

这个领域涵盖的内容

下面的列表遵循 SY0-701 官方公布的考试大纲。这里深度比广度更重要：考试要求你把这些概念应用到具体场景中，而不是背诵它们。

  • 将安全技术应用于计算资源:加固目标、无线安全设置、移动解决方案和应用程序安全。
  • 资产全生命周期管理,从采购到安全处置和清除。
  • 漏洞管理:识别方法、分析、响应与修复、验证和报告。
  • 安全告警与监控,以及支持它的工具——SIEM、DLP、SNMP陷阱、NetFlow、防病毒软件和漏洞扫描器。
  • 身份与访问管理,包括账户配置、权限分配、MFA、密码概念和特权访问管理。
  • 自动化与编排,以及涵盖准备到经验总结全过程的事件响应,包括根因分析和数字取证。
常见错误

考生容易失分的地方

  • 搞错事件响应的顺序。遏制先于根除,根除先于恢复——大多数错误答案是在攻击者仍有访问权限时就恢复了服务。
  • 把漏洞扫描结果当作结论而不是输入。考试经常问你拿到一个发现后该做什么,包括确认它不是误报。
  • 在身份场景中混淆身份认证与授权,尤其是MFA和特权访问同时出现的时候。

如果时间紧张,应优先攻克这个域——它在考试中占比最大,而且最看重操作判断力而非死记硬背。在这里多练习事件响应的先后顺序,回报比其他任何地方都来得快。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. Create a free account to save your progress. No card required.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

看看这是不是你的薄弱领域

20 道免费 Security+ 题目，无需信用卡。准备度按领域呈现，这样你就能看出 Security Operations 是不是复习该重点关注的地方。

免费开始

Security+ 的其他领域