Vulnerability Management and Security Assessment
Vulnerability Management and Security Assessment
This domain tests whether you can find, validate, prioritize and close vulnerabilities using risk rather than raw scanner output, and whether you know how assessment types differ.
Core rules
- Asset inventory and scan coverage come first; you cannot manage what you have not enumerated.
- Credentialed (authenticated) scans see installed packages and configuration; unauthenticated scans see the exposed surface and produce more false positives.
- CVSS gives base, temporal and environmental scores. Base score alone is not a priority.
- EPSS estimates probability of exploitation in the near term; CISA KEV lists vulnerabilities known to be exploited. Either should push a finding up.
- Prioritize using exploitability, exposure, asset criticality and data sensitivity, not severity alone.
- Patch SLAs by severity tier, with compensating controls and time-boxed exceptions where patching is impossible.
- Vulnerability scanning is broad and automated; penetration testing is scoped, manual, goal-driven and requires rules of engagement.
Worked example
Two findings compete for the same maintenance window. One is an internet-facing VPN appliance rated 9.8 and listed in CISA KEV; the other is an internal reporting server at 7.5 with no known exploit. Fix the VPN first: it is reachable, actively exploited in the wild, and compromises the perimeter. The internal finding goes into normal SLA tracking and gets revalidated on the next scan.
Traps that cost marks
- Ranking purely by CVSS score and ignoring KEV or EPSS.
- Running unauthenticated scans and reporting every result as confirmed.
- Confusing a scan report with a penetration test or an audit.
- Opening exceptions with no expiry, owner, or compensating control.