Vulnerability Management and Secure Development
What to know
Vulnerability management is a continuous cycle: asset inventory, scanning, validation, prioritization, remediation, and verification. Understand why prioritization must combine severity with exploitability, exposure, and business criticality - a critical score on an unreachable host may rank below a moderate flaw on an internet-facing system. Know the roles of authenticated versus unauthenticated scans, agent-based versus network scanning, and false positive handling.
Secure development concepts: secure coding standards, threat modeling, security requirements, code review, static and dynamic analysis, software composition analysis for dependencies, and penetration testing. Understand the difference between SAST (code, early, no running app), DAST (running app, black-box), and SCA (third-party components). Know how a vulnerability becomes a defect with an owner and a deadline.
Supply chain security matters: dependency provenance, signed artifacts, build pipeline integrity, and vendor assurance. Change management and segregation of development, test, and production environments reduce risk. Understand risk-based patch SLAs and compensating controls when patching is delayed.
Traps
Questions often treat scanner output as ground truth; validation is required. Another trap: assuming a high CVSS score alone determines priority. Beware options that patch production without change control, or that rely on annual penetration tests as a substitute for continuous scanning. Also, SAST cannot find runtime configuration issues, and DAST cannot see code paths it never reaches.
Worked example
A scan reports a critical vulnerability on an internal test server with no sensitive data, while a medium-severity flaw affects an internet-facing payment API. Risk-based prioritization fixes the payment API first and documents a compensating control and timeline for the test server.
Rule of thumb: prioritize by exploitability and business exposure, not by score alone.