CompTIA Security+ SY0-701 · Free study guide

Objective 4.3 — Operate a vulnerability management program

Vulnerability management is a lifecycle: identify, confirm, contextualize, prioritize, respond, validate, and report. A scanner output is evidence for analysis, not a complete risk decision.

Identification sources include network and authenticated scans, static and dynamic application analysis, package monitoring, threat intelligence, penetration tests, audits, and responsible-disclosure or bug-bounty reports. Authenticated scanning usually sees configuration and software detail that remote scanning cannot. Agentless and agent-based coverage have different blind spots.

Analyze before prioritizing

Confirm findings to distinguish false positives. Also consider false negatives: a clean scan may reflect missing credentials, unreachable assets, or incomplete signatures. CVE identifiers provide common references, while CVSS supplies standardized severity dimensions. Neither includes all local context.

Prioritization should combine exploit availability, reachability, asset value, data sensitivity, exposure factor, business impact, control coverage, and organizational risk tolerance. An internet-facing exploited weakness on an identity system may outrank a higher base score on an isolated test host.

Respond and validate

Patching is common, but not the only response. Segmentation, feature disablement, configuration change, isolation, or another compensating control may reduce risk when a fix is unavailable. Insurance transfers some financial impact; it does not remove the vulnerability. Exceptions and exemptions require owner, justification, expiry, scope, and review.

Validate remediation by rescanning or testing the affected condition. “Patch installed” is not enough if the service still exposes the old component or the change failed. Audit the process and report status with clear population, timestamps, exclusions, aging, and risk ownership.

Program metrics should encourage risk reduction rather than easy closure. Track critical exposure age, overdue exceptions, asset coverage, credentialed-scan success, remediation validation, and recurrence. A falling finding count can be bad news if inventory coverage also fell.

Decision rule: prioritize contextual exposure, choose an owned treatment, and independently verify the vulnerable condition no longer creates the same risk.