CompTIA Security+ · 考试领域

Threats, Vulnerabilities & Mitigations：Security+ 考察什么，如何备考

这是大多数人认为考试应该考察的核心域。它涵盖威胁行为者及其动机、攻击面、考试要求你识别的漏洞类型,以及应对这些漏洞的缓解措施。

免费练习这个领域 Security+ 概览
范围

这个领域涵盖的内容

下面的列表遵循 SY0-701 官方公布的考试大纲。这里深度比广度更重要：考试要求你把这些概念应用到具体场景中，而不是背诵它们。

  • 威胁行为者类型及其特征——国家支持者、技能不足的攻击者、黑客活动分子、内部威胁、有组织犯罪、影子IT——以及他们的动机。
  • 威胁向量与攻击面:基于消息、基于图像、基于文件、可移动设备、易受攻击的软件、不受支持的系统、供应链。
  • 应用程序、操作系统、Web、硬件、虚拟化、云、供应链和密码学等各方面的漏洞类型。
  • 恶意活动指标:恶意软件、物理、网络、应用程序和密码学攻击。
  • 缓解技术,包括分段、访问控制、隔离、加固、补丁管理、加密和监控。
常见错误

考生容易失分的地方

  • 给攻击匹配一个看似合理的缓解措施,而不是最佳措施。通常有几个选项都有帮助,但考试要的是针对题目所述具体弱点的那一个。
  • 把威胁行为者问题当作单纯的记忆题。真正决定答案的是关键属性——资源、技术水平、动机——而不是标签本身。
  • 忽视"不受支持的系统和应用程序"本身就是一种独立的攻击向量。它出现的频率比考生预期的要高。

练习在看选项之前先从场景中找出具体的弱点。这个域最常见的错误是正确识别出了攻击类别,却选了一个针对该类别中另一种攻击的控制措施。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. Create a free account to save your progress. No card required.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

看看这是不是你的薄弱领域

20 道免费 Security+ 题目，无需信用卡。准备度按领域呈现，这样你就能看出 Threats, Vulnerabilities & Mitigations 是不是复习该重点关注的地方。

免费开始

Security+ 的其他领域