CompTIA Security+

Security+ 的基于表现题目：是什么，如何练习

Security+ 的 PBQ 常常要求你放置安全控制措施、把攻击手段与对应的缓解措施匹配起来，或者给事件响应流程排序。在整场考试中，这部分恰恰是“背定义”最没用、“理解控制措施为何放在那里”最有用的地方。

免费练习 Security+ Security+ 详情
考试在考察什么

为什么会有这些题目

Security+ 的 PBQ 考察的是位置与顺序：不是问某项控制措施“是什么”，而是问它“该放在哪里”“该在什么时候用”。这正是死记硬背缩写表的考生，和真正理解架构的考生之间的分水岭。

在真实考试中，它们表现为performance-based questions (PBQs)。Multiple-choice (single and multiple response) plus performance-based questions (PBQs)

  • 做控制措施放置类题目时，先想清楚你要保护的是什么，再决定部署什么。是资产决定控制措施，而不是反过来。
  • 做事件响应排序题时，记住遏制在根除之前，根除在恢复之前。大多数排序错误都是在移除攻击者之前就恢复了服务。
  • 当两个答案看起来都说得通时，优先选择解决根因而非症状的那个。

Try three questions. Understand every answer.

Original English practice examples, with answers and explanations available here. No account required. These are independent teaching examples, not official exam questions or exam dumps.

Question 1 of 3 · Threats, vulnerabilities, and mitigations

An internet-facing service has an actively exploited vulnerability. The vendor has no patch yet, but offers a documented workaround that blocks the known exploit path. Which action best reduces immediate risk without claiming the flaw is permanently fixed?

Answer and explanation

Best answer: Validate and apply the workaround, monitor it, and track the pending patch

A validated compensating control can reduce exposure while the permanent fix is pending. Retain the vulnerability record, residual risk, and a plan to apply and verify the patch.

Why the other choices fit less well

Waiting leaves exposure unchanged, and a hostname change does not block the flaw. A workaround reduces risk without necessarily removing the vulnerability, so closing it as permanently fixed overstates the evidence.

CISA: known exploited vulnerabilities

Question 2 of 3 · Security architecture

An analyst needs read-only access to one reporting dataset for a two-week investigation. Which access decision best follows least privilege?

Answer and explanation

Best answer: Grant approved read-only access to that dataset with a reviewed expiry

Limit permissions to the approved task, resource and duration. Review the expiry and record the grant so access can be removed when the investigation ends.

Why the other choices fit less well

Permanent administrator rights exceed the task. Shared credentials weaken individual accountability. Disabling logs removes evidence without reducing the permissions required.

NIST: least privilege

Question 3 of 3 · Security operations

An investigator hashes a collected log file, then transfers it to an analysis workstation. The hash of the received file differs. What is the most defensible next step?

Answer and explanation

Best answer: Preserve both records and investigate or repeat the transfer before relying on the copy

The received bytes have not passed the expected integrity check. Preserve the acquisition record and investigate the discrepancy or acquire a verified copy.

Why the other choices fit less well

A filename does not establish byte-level integrity. Replacing the original hash hides the discrepancy. Do not describe the copy as verified until the mismatch is resolved.

NIST: forensic evidence handling

Choose your next step

Free practice questions: 20 for Security+. Create a free account to save your progress. No card required.

Try 20 Security+ questions freePrefer a short check? Take the 10-question Security+ diagnostic.

Paid question-bank access is a one-time purchase, with no recurring subscription. Official exam registration, vouchers and provider labs are separate from CertSprint practice.

你在这里能得到什么

我们如何练习它们

我们的 Security+ 题库包含 31 道 PBQ 风格练习题，分为两种形式：匹配任务（将每项需求与满足它的能力配对）和排序任务（将某个流程的步骤排序）。每道题都附有和选择题相同的完整解析，说明为什么正确的安排是对的，以及为什么看似合理的选项是错的。

这些练习训练的是考试所考察的推理能力——顺序、定位和匹配——而不是复刻厂商的模拟界面。这里的任何内容都不会重现真实的考试环境，任何练习产品也都不应该合法地这样做。

看看你在 Security+ 上处于什么水平

20 道免费题目，无需信用卡。你的领域得分会显示在预约考试前哪些方面还需要加强。

免费开始

相关内容

CompTIA Security+ 练习题 · 全部六个认证 · CertSprint 如何运作

有依据地练习

理解答案背后的判断。

先分析情境，找出关键证据，再对照解析检查自己的推理。根据各领域的得分决定下一次复习重点。练习正确率只能提示学习进度，不能预测正式考试成绩，也不等同于官方分数。

最新练习集提供八种语言版本。较早的练习可能以英语显示。这些是独立编写的原创练习情境，并非官方考试题目。