Security+ level · Domain 4.0 Security Operations · 28% of the mapped exam

4.3 Explain various activities associated with vulnerability management.

33 topics · 5 quiz questions

Vulnerability management is a continuous cycle: find weaknesses, confirm and prioritise them, fix or mitigate them, verify the fix and report. Prioritisation is the hard part, because there are always more findings than time.

Identification methods

Vulnerability scan: Automated tool checking systems for known vulnerabilities and misconfigurations. Credentialed scans see more.
Static analysis: Examining source code without running it (SAST).
Dynamic analysis: Testing a running application from the outside (DAST, fuzzing).
Package monitoring: Tracking third-party libraries for known vulnerabilities (software composition analysis).
Threat feed: A stream of indicators and vulnerability intelligence.
Open-source intelligence (OSINT): Publicly available information: advisories, blogs, social media, public databases.
Proprietary/third-party: Commercial intelligence feeds.
Information-sharing organization: Industry groups (ISACs) where members share threat information.
Dark web: Monitoring criminal forums and markets for leaked data, credentials or attack plans.
Penetration testing: Authorized simulated attacks that prove whether vulnerabilities can actually be exploited.
Responsible disclosure program: A published way for outside researchers to report vulnerabilities safely.
Bug bounty program: Paying researchers for valid vulnerability reports under defined rules.
System/process audit: Reviewing systems and processes against standards to find weaknesses.

Analysis

Confirmation: Verifying a finding is real before acting.
False positive: A reported vulnerability that is not actually present. Wastes time.
False negative: A real vulnerability the tool missed. More dangerous because it gives false confidence.
Prioritize: Rank findings by severity, exploitability, exposure and asset value.
Common Vulnerability Scoring System (CVSS): Standard 0–10 severity score based on how a vulnerability is exploited and its impact.
Common Vulnerability Enumeration (CVE): Unique public identifier for a known vulnerability, such as CVE-2024-12345.
Vulnerability classification: Grouping by type (injection, misconfiguration) or severity.
Exposure factor: The percentage of an asset's value lost if the vulnerability is exploited.
Environmental variables: Your own context (internet-facing or not, compensating controls) that raises or lowers real risk compared with the base score.
Industry/organizational impact: How exploitation would affect your sector and business.
Risk tolerance: How much risk the organisation is willing to accept, which shapes remediation deadlines.

Vulnerability response and remediation

Patching: Applying the vendor fix. The preferred remediation.
Insurance: Cyber insurance transfers some financial impact; it does not fix the vulnerability.
Segmentation: Isolating the vulnerable system to reduce exposure.
Compensating controls: Alternative protections (WAF rule, disabling a feature) when patching is not yet possible.
Exceptions and exemptions: Formally documented, approved and time-limited acceptance of an unremediated vulnerability.

Validation of remediation

Rescanning: Scan again to confirm the vulnerability is gone.
Audit: Independent check that remediation followed process.
Verification: Manual or automated confirmation that the fix works and did not break anything.

Reporting

Reporting: Communicating status, trends, risk and overdue items to owners and leadership.

Check your understanding

< 4.2 previous 4.4 next >

Original CoreQ Academy material, mapped to objective 4.3 of the publicly available CompTIA Security+ SY0-701 exam objectives (Exam objectives V7, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.