Security+
4.3Security Operations · 28% of exam

Explain various activities associated with vulnerability management

Discovery, analysis, prioritization with CVSS and CVE, remediation, validation, and reporting.

Reading time
28 min read
Flashcards
22 cards
Practice questions
12 questions · 4 PBQs

Vulnerability management is the SOC's routine work, and CompTIA tests it as a lifecycle rather than as a list of tools. Learn the sequence and most questions answer themselves.

It is also where two scoring systems live — CVE and CVSS — and the exam reliably tests the difference.

The lifecycle

Identify → analyse → prioritise → remediate → validate → report. Then round again.

Check yourself

A scanner reports a critical vulnerability. The team patches it. What must happen before the finding is closed?

Identification

Several sources, and the exam wants you to distinguish them.

Vulnerability scan

Automated discovery of known weaknesses by checking versions, configurations and signatures. Broad and shallow.

Penetration test

A human actively exploiting weaknesses to prove they are reachable. Narrow and deep.

Bug bounty

Paying external researchers for vulnerabilities they find and report responsibly.

Threat feed / OSINT

External intelligence: advisories, dark web monitoring, information-sharing organisations (ISACs), proprietary feeds.

SCAP

Security Content Automation Protocol — the standard that lets scanners from different vendors describe findings consistently.

Credentialed scan

  • Scanner logs in to the host
  • Sees installed patches and config
  • Far more accurate, fewer false positives

Non-credentialed scan

  • Probes from outside with no login
  • Sees only what an unauthenticated attacker sees
  • More false positives, less depth

The tellIf a question complains about false positives or missing detail, the fix is almost always a credentialed scan.

Also know static vs dynamic analysis: static (SAST) reads source code without running it; dynamic (DAST) tests the running application. And passive vs active scanning: passive watches traffic and cannot disrupt anything; active sends probes and can.

CVE vs CVSS

The single most testable pair in this objective.

CVE

  • Common Vulnerabilities and Exposures
  • An IDENTIFIER — a unique name
  • CVE-2021-44228 (Log4Shell)
  • Says nothing about severity

CVSS

  • Common Vulnerability Scoring System
  • A SEVERITY SCORE, 0.0 to 10.0
  • 9.8 Critical
  • Says nothing about which vulnerability

The tellCVE names it, CVSS rates it. One is a label, the other a number.

CVSS severity bands: 0.1–3.9 Low, 4.0–6.9 Medium, 7.0–8.9 High, 9.0–10.0 Critical.

Check yourself

A report lists CVE-2021-44228 with a CVSS score of 10.0. What does the CVE portion tell you?

Prioritisation beyond the score

CVSS alone is not a priority. The exam expects you to weigh context:

  • Exposure — internet-facing beats internal.
  • Asset criticality — a domain controller beats a test box.
  • Exploitability — is there working exploit code in the wild? A weaponised 7.5 outranks a theoretical 9.8.
  • Compensating controls — already mitigated by segmentation or a WAF? Lower urgency.

Analysis: the four outcomes

True positive

  • Reported and real
  • Fix it

False positive

  • Reported but not real
  • Tune the scanner

True negative

  • Not reported and not there
  • Correct silence

False negative

  • Not reported but real
  • The dangerous one

The tellFalse NEGATIVE is the one that hurts: a real vulnerability the scanner missed, so nobody is looking for it.

Responses to a vulnerability

Four options, and they map onto the risk responses in 5.2:

Remediate — patch or fix it. The default. Mitigate / compensating controls — reduce impact when you cannot patch (segmentation, WAF rule, disabling a feature). Accept / exception — document the risk and live with it, with sign-off. Requires an expiry and review date. Transfer — insurance or shifting to a third party.

Exception vs exemption

An exception is temporary and time-bound, granted because remediation is not possible right now. An exemption is a standing, ongoing approval. Both require documented approval — an undocumented decision to not patch is not a risk acceptance, it is negligence.

Validation and reporting

Rescanning confirms the fix. Audit verifies the process was followed. Verification confirms the specific finding is closed.

Reporting closes the loop: trends over time, mean time to remediate, and which systems repeatedly appear. A programme that never reports cannot show whether it is working.