Vulnerability Management
Vulnerability management is a continuous cycle: inventory assets, scan, validate, prioritize, remediate, verify, and report. The exam tests prioritization judgment and the difference between finding a weakness and fixing it.
Core rules
- Inventory first: you cannot scan what you do not know. Include cloud instances, containers, network devices, and shadow IT. Assign owners and business criticality.
- Credentialed scans see installed packages and missing patches; uncredentialed scans see exposed services. Use both. Safe checks avoid crashing fragile systems; scan windows and change approval reduce operational risk.
- Validate results: false positives waste remediation effort; false negatives create false confidence. Confirm with manual checks or a second tool before assigning work.
- Scoring: CVE identifies the flaw, CWE the weakness class, CVSS gives base, temporal, and environmental severity, EPSS estimates exploitation probability, and CISA KEV lists exploited vulnerabilities. None alone equals risk.
- Prioritize using exposure, asset criticality, exploit availability, and business impact. Internet-facing, exploitable, high-value systems come first. Remediate by patching, configuration change, compensating control, or documented exception with expiry.
- Verification and metrics: rescan to confirm closure, track mean time to remediate by severity, and report trends. Penetration tests and red teams validate exploitability but do not replace broad scanning; threat modeling finds design flaws scanners miss.
Worked example
Two findings: CVSS 9.8 on an isolated lab host with no route to production, and CVSS 6.5 on an internet-facing VPN appliance listed in KEV with a public exploit. The 6.5 goes first. Reasoning: CVSS base score omits exposure and threat intelligence; KEV plus internet reachability plus a known exploit makes exploitation likely and consequential, while the lab host's blast radius is contained.
Traps that cost marks
Treating the highest CVSS score as the top risk; assuming a clean scan means secure; closing a ticket without a rescan; suppressing a finding without a compensating control or expiry; and patching production without testing or rollback.