I85PREP
⌘ K
CCIS study materials
CCIS study resources

CCIS: Vulnerability and Risk Management

CCIS · Work through your exam, one topic at a time.

All guide sections

Vulnerability and Risk Management

Domain 7: Vulnerability and Risk Management

This domain tests how organizations find, prioritize, and reduce vulnerabilities and how they record and govern risk. Expect questions on scanning versus penetration testing, CVSS, exploit prediction, asset criticality, patch service levels, risk registers, exceptions, and threat modeling.

Core rules and concepts

  • A vulnerability scan identifies known weaknesses and misconfigurations; a penetration test validates exploitability and business impact. Neither proves the absence of vulnerabilities.
  • CVSS base score measures technical severity, not business risk. Context includes exposure, asset criticality, data sensitivity, threat activity, and compensating controls. EPSS estimates the probability of exploitation in the near term.
  • Prioritize by combining severity, exploitability, exposure, and business impact. Internet-facing, remotely exploitable, actively exploited flaws should be remediated first.
  • Patch service levels should be risk-based and measured. When patching is blocked, use compensating controls with an owner and expiry.
  • A risk register records description, likelihood, impact, owner, treatment, and review date. Risk acceptance must be made by the accountable business owner, not the security analyst alone.
  • Threat modeling asks what can go wrong, what controls exist, and what to do next. Use data-flow and trust-boundary thinking.

Worked example

Two findings appear. One is CVSS 9.8 on an isolated lab server with no sensitive data and no internet route. The other is CVSS 7.5 on an internet-facing payment API with known exploitation in the wild. You prioritize the payment API: it is exposed, business-critical, and actively targeted. You patch it within the emergency service level and add virtual patching at the WAF until the change window. The lab server is scheduled normally. Reasoning: CVSS alone would rank the lab first; exposure, asset criticality, and threat activity change the decision.

Traps that cost marks

Do not rank by CVSS score alone. Do not equate a clean scan with a secure system. Do not accept risk without a named owner and expiry. Do not treat a penetration test as a substitute for continuous scanning. Do not close a finding because a compensating control exists but is untested.