Threat and Vulnerability Assessment
What this domain tests
CASSPT candidates must show they can turn raw vulnerability data and threat intelligence into defensible risk decisions. The exam tests threat modeling, vulnerability discovery, validation, scoring, and prioritization in business context, not scanner operation alone.
Core rules and concepts
- Threat vs. vulnerability vs. risk: a threat is a potential actor or event; a vulnerability is a weakness; risk combines likelihood and impact with asset value.
- Threat modeling uses structured methods such as STRIDE, attack trees, or kill-chain analysis to find design weaknesses before code exists.
- Vulnerability assessment is continuous: inventory assets, scan, validate findings, assign ownership, remediate, and retest.
- Scoring is input, not output. CVSS base scores describe severity; EPSS estimates exploitation probability; CISA KEV confirms known exploitation. None alone sets priority.
- Context factors include internet exposure, data sensitivity, compensating controls, exploit maturity, and business criticality.
- Supply chain findings such as vulnerable dependencies and exposed build secrets belong in the same risk workflow.
Worked example
A scanner reports CVSS 9.8 in an internal image-parsing service. The service is not internet-facing, requires authenticated access, and sits behind a WAF and egress filtering. A separate CVSS 7.5 vulnerability affects an internet-facing VPN with public exploit code and no compensating control. The correct priority is the VPN: exposure and known exploitation raise real risk, while the 9.8 finding is still tracked and patched but ranked lower. Document the rationale and retest both.
Traps that cost marks
Treating CVSS as a complete risk score; forwarding scanner output without validation; ignoring asset criticality; missing false positives and false negatives; confusing a threat with a vulnerability; and failing to close the loop with retesting or risk acceptance.
Exam-ready summary
Prioritize by exploitability, exposure, impact, and control strength. Record the decision and owner.