Vulnerability Management
Vulnerability Management
This domain tests the full lifecycle - knowing what you own, measuring weakness, deciding what to fix first, and proving the fix. The exam rewards risk-based prioritization over raw scores and punishes treating a scanner report as a list of confirmed exploits.
Inventory first
Unmanaged assets are unprotected assets. Combine agent-based inventory, authenticated discovery scans, and a CMDB, and reconcile the differences. Credentialed scans read installed patch levels and configuration; uncredentialed scans see only network-visible services and generate far more false positives.
Scoring and prioritization
- CVE identifies a specific flaw; CPE names the affected product.
- CVSS has three groups: base (intrinsic, static), temporal (exploit maturity, remediation level), environmental (your exposure and asset criticality).
- EPSS estimates the probability of exploitation in the near term.
- KEV lists vulnerabilities known to be exploited in the wild - patch these first regardless of score.
Scanning versus testing
A vulnerability scan identifies potential weaknesses without exploiting them. A penetration test uses authorized exploitation to prove business impact. SAST reads source code, DAST probes a running application, SCA inspects dependencies, and image scanning checks container layers and base images.
Remediation lifecycle
Discover → validate and triage false positives → prioritize → remediate (patch, configuration change, or documented compensating control) → verify with a rescan → close with evidence. Exceptions need a named owner, a justification, and an expiry date; open-ended exceptions are audit findings.
Worked example
A scan reports CVSS 9.8 on an internal build server with no internet route and no stored credentials, and CVSS 6.5 on an internet-facing VPN appliance that appears in KEV. Fix the VPN first: KEV membership implies active exploitation, and internet exposure is the dominant environmental factor multiplying likelihood. Record the build server as accepted risk with a dated patch plan.
Traps
CVSS base score is severity, not risk - environmental and threat context decide. A clean scan does not prove absence of vulnerabilities. Aggressive scanning of production can cause outages, so agree windows and use safe checks. Scanners rarely confirm exploitability; verify before escalating a critical finding.