Security+
CompTIA Security+ SY0-801 / All lessons / Domain 4.0: Security Operations
4Domain 4.0: Security Operations
Security+ topic 4.3

Vulnerability Management

Vulnerability management is a cycle: identify, analyze, respond, and verify. Teams find weaknesses with vulnerability scans, application testing, threat feeds, penetration tests, and bug bounty programs. Each finding is checked for false positives, then prioritized using the CVSS score, the CVE identifier, how exposed the system is, and how important it is to the business. Responses include patching, compensating controls, segmentation, insurance, or formally accepting the risk with an exception. A rescan confirms the fix worked, and results are reported to leadership.

Picture itIdentifyAnalyzeRespondVerifyscan, CVE, CVSSpatch, rescan, report
Vulnerability management is a cycle that never ends.

Vulnerability Management vocabulary

  • CVE: Common Vulnerabilities and Exposures: a public ID number for a known vulnerability.
  • CVSS: Common Vulnerability Scoring System: a 0 to 10 score of how severe a vulnerability is.
  • False positive: A scan result that reports a vulnerability that is not really there.
  • Bug bounty: A program that pays outside researchers for responsibly reporting vulnerabilities.

Exam-style practice questions

Try each one, then open the answer. To save your progress, take this quiz in the interactive course.

1. A scan reports a critical vulnerability on a server, but the vulnerable software is not installed. Which of the following is this?

  1. (A) A true positive
  2. (B) A false positive
  3. (C) A false negative
  4. (D) A zero-day
Show answer

(B) A false positive Reporting a vulnerability that is not there is a false positive.

2. Which of the following provides a numeric severity score from 0 to 10 for a vulnerability?

  1. (A) CVE
  2. (B) CVSS
  3. (C) SCAP
  4. (D) SOAR
Show answer

(B) CVSS CVSS scores severity. CVE is the identifier.

3. A patch for a critical flaw cannot be installed for 30 days. Which of the following is the best response in the meantime?

  1. (A) Ignore the flaw until the patch
  2. (B) Apply a compensating control, such as segmentation, and document an exception
  3. (C) Remove all logging
  4. (D) Publish the flaw on social media
Show answer

(B) Apply a compensating control, such as segmentation, and document an exception Compensating controls reduce risk while a fix is delayed.

4. After a patch is installed, which of the following confirms the vulnerability is fixed?

  1. (A) A rescan
  2. (B) A tabletop exercise
  3. (C) A risk transfer
  4. (D) A new password policy
Show answer

(A) A rescan Rescanning verifies remediation.

Open 4.3 in the interactive course