Vulnerability and Risk Management
What the exam tests
This domain tests whether you can turn scanner output into a defensible remediation order and document the decisions you cannot fix.
Core rules
- The CVSS base score measures technical severity in a vacuum. Risk equals likelihood multiplied by impact, adjusted for exposure, asset criticality, and active threat activity.
- CISA KEV and EPSS add the exploitation dimension. A CVSS 7.5 listed in KEV outranks a CVSS 9.8 with no exploitation observed and no reachable path.
- Environmental and temporal metrics exist because asset context differs from vendor defaults; set them explicitly rather than accepting the base score.
- Authenticated scans find substantially more than unauthenticated ones. A program running only unauthenticated scans reports false comfort on missing patches and misconfigurations.
- Exceptions are formal: named owner, compensating control, expiry date, and scheduled re-review. Verbal risk acceptance is not a control.
- Every finding resolves to patch, mitigate, or remove. Segmentation, WAF rules, or disabling a service count as mitigation only when you can evidence them.
Worked example
Two findings. Finding A carries CVSS 9.8 on an isolated build server with no internet route and no credential path from user space. Finding B carries CVSS 7.2 on an internet-facing VPN appliance, appears in KEV, and has EPSS 0.61. Remediation order: Finding B first. Reasoning: KEV means exploitation is observed in the wild, the appliance is reachable from the internet, and VPN compromise yields an entry point into the estate. Finding A stays on the backlog with the isolation documented as a compensating control and a scheduled patch window, not marked closed.
Traps
- Sorting purely by CVSS and declaring the program mature.
- Marking a finding false positive without manually validating the banner or version.
- Letting exceptions auto-renew without a fresh risk decision.
- Confusing patch availability with remediation.