CompTIA Security+ · 考试领域

Security Program Management & Oversight：Security+ 考察什么，如何备考

这是治理、风险与合规域。它是技术性最弱、也是考生最容易低估的域,因为它是用商业语言而不是工具词汇写成的。

免费练习这个领域 Security+ 概览
范围

这个领域涵盖的内容

下面的列表遵循 SY0-701 官方公布的考试大纲。这里深度比广度更重要：考试要求你把这些概念应用到具体场景中，而不是背诵它们。

  • 安全治理:指导方针、政策、标准、程序、外部考量因素以及治理架构。
  • 风险管理——识别、评估、分析、风险登记册、风险容忍度与风险偏好,以及应对选项:转移、接受、规避和缓解。
  • 第三方风险评估与管理,包括供应商选择、协议类型和持续监控。
  • 合规性:报告、监控、不合规的后果以及隐私考量。
  • 审计与评估,包括内部与外部审计、认证和渗透测试。
  • 安全意识实践,从钓鱼识别到报告和监控。
常见错误

考生容易失分的地方

  • 混淆风险偏好与风险容忍度。二者相关但不可互换,考试会考察这一区别。
  • 不假思索地选择"缓解"。当场景提到成本或业务限制时,接受或转移风险往往才是正确答案。
  • 混淆协议类型——MSA、SOW、SLA、MOU、NDA、BPA。这些是直接的记忆题,学会了就是白送的分数。

不要因为这个域看起来技术性不强就把它留到最后。它几乎占考试的五分之一,而且题目大多是定义型的,是Security+复习中每小时投入产出比最高的部分。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. Create a free account to save your progress. No card required.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

看看这是不是你的薄弱领域

20 道免费 Security+ 题目，无需信用卡。准备度按领域呈现，这样你就能看出 Security Program Management & Oversight 是不是复习该重点关注的地方。

免费开始

Security+ 的其他领域