Vulnerability Assessment and Management
Domain 4 covers the vulnerability management lifecycle: inventory, scan, validate, prioritize, remediate, and verify. The exam emphasizes risk-based prioritization rather than chasing every CVSS 10.
Core rules and concepts
- You cannot protect unknown assets; maintain an asset inventory with owners and criticality.
- CVE identifies a specific flaw; CVSS scores severity but not business context. EPSS estimates exploitation likelihood; KEV lists known exploited vulnerabilities.
- Authenticated scans find missing patches and misconfigurations; unauthenticated scans see the attacker's view. Use both.
- False positives must be validated before remediation; false negatives hide exposure.
- Remediation options include patching, configuration change, compensating controls, isolation, and documented risk acceptance.
- Re-scan after fixes and track aging, coverage, and exception expiry.
Worked example
Two findings: CVSS 9.8 on an internet-facing web server and CVSS 7.5 on an isolated lab workstation. Prioritize the web server first: it is reachable, likely exploitable, and may hold customer data. The lab host still needs a fix, but scheduled maintenance is acceptable if compensating controls exist. Reasoning: exposure and business impact modify severity; CVSS alone is not a priority.
Traps that cost marks
Scanning is not remediation. A high CVSS score does not always mean first fix. Ignoring scan credentials produces incomplete results. Risk acceptance must be documented and time-bound, not verbal.