Vulnerability management, end to end

Objective 4.3 in this course covers vulnerability management — CompTIA's scope note for it identifies, analyses, remediates, validates and reports vulnerabilities. One objective out of twenty-eight, so this is one lesson rather than four. Our CompTIA CySA+ CS0-004 course takes the same ground considerably further, because CS0-004 examines it as a whole domain; SY0-701 does not, and this lesson is scoped to what SY0-701 asks.

Why this matters

Vulnerability management is a cycle, and the exam tests the cycle rather than the scanner. Candidates who revise "run Nessus" lose marks on the questions that actually appear: how findings are prioritised, what to do about a false negative, why rescanning matters, and what to report to whom.

The most commonly missed idea is that the output of a scan is not a work list. It is raw material that has to be validated, prioritised against business context, and turned into decisions — some of which are "accept this".

The lesson

Discovery: scanning, application security testing, threat feeds, bug bounty, pen test

CompTIA names several identification methods, and they are complementary rather than alternatives.

• Vulnerability scanning — automated, broad, regular. Credentialed (authenticated) scans log in and see installed versions and configuration, so they are far more accurate; non-credentialed scans see only what is exposed and approximate the outside attacker's view. Use credentialed for coverage and non-credentialed to understand exposure.
• Static and dynamic application security testing (SAST/DAST) — from the application security lesson: static reads code, dynamic exercises a running application. Package monitoring watches your dependencies for newly disclosed vulnerabilities, which is where the SBOM pays off.
• Threat feeds — OSINT, commercial feeds, information-sharing organisations (ISACs) for your sector, and the dark web monitoring that tells you your credentials are for sale. Their value is that they tell you what is being exploited, which is a different question from what is present.
• Penetration testing — human, targeted, and able to chain findings a scanner reports as individually low. It answers "is this actually exploitable?", which no scanner can.
• Bug bounty — paying external researchers for reported vulnerabilities. Its value is many skilled people testing continuously; its cost is triage volume. It also gives the ethically motivated researcher from Domain 2 a route that is not public disclosure.
• System and process audits — finding the vulnerability that is procedural rather than technical.

The point to carry: no single method finds everything, and the gaps are predictable. Scanners miss logic flaws and chained attacks; pen tests are a point in time; bug bounties find what is reachable from outside.

Analysis: CVSS, CVE, true and false positives and negatives, prioritisation

CVE is an identifier — a unique name for a specific publicly known vulnerability. It is a label, not a score.

CVSS (Common Vulnerability Scoring System) is the severity score, 0.0 to 10.0, from the base metrics of the vulnerability itself — how it is accessed, how complex exploitation is, what privileges and interaction are needed, and the impact on confidentiality, integrity and availability. SY0-701 expects you to read a CVSS score and know the qualitative bands (low, medium, high, critical), not to compute vectors.

The four outcomes, which are examined directly:

• True positive — reported and real.
• False positive — reported and not real. Costs time, and in volume trains people to ignore findings.
• True negative — not reported and not there.
• False negative — not reported and real. The dangerous one, because nothing tells you it happened. Non-credentialed scans produce them routinely, which is a strong argument for credentialed scanning.

Prioritisation is the part people get wrong by sorting the CSV on the severity column. CVSS describes the vulnerability in the abstract; your priority depends on context the score does not contain:

• Exposure — internet-facing or on an isolated internal segment?
• Asset criticality and data classification — what does the host do and what does it hold?
• Exploit availability — is there working public exploit code, and is it being used in the wild? A medium-severity vulnerability under active exploitation outranks a critical one with no known exploit.
• Compensating controls already in place.
• Environmental and temporal CVSS metrics exist precisely to express some of this.

The exam's expected reasoning: an internet-facing, actively exploited, medium-severity finding is more urgent than an internal critical with no exploit.

Response: patching, insurance, segmentation, exceptions and compensating controls

CompTIA lists the remediation options, and the exam wants you to know that patching is one of several legitimate answers rather than the only one.

• Patching — removes the vulnerability. The default, and it goes through change management from Domain 1.
• Segmentation — reduces reachability when patching is not possible.
• Compensating controls — a different control addressing the same risk: virtual patching at a WAF or IPS, tightened access control, additional monitoring.
• Insurance — transferring the financial consequence. It transfers money, never the obligation or the reputational damage, and insurers increasingly require specific controls to be in place.
• Exceptions and exemptions — the documented decision not to remediate. These are legitimate and must be time-bounded, owned by someone with the authority to accept the risk, and recorded in the risk register from Domain 5. An exception with no expiry is how a temporary decision becomes a permanent vulnerability.
• Purchasing insurance, accepting the risk — the Domain 5 vocabulary of transfer and accept, applied here.

Validation: rescanning, audit and verification

Remediation is a claim until it is verified, and this is the stage skipped most often.

• Rescanning is the direct check: run the scan again and confirm the finding is gone. This catches the patch that was downloaded and not applied, applied and not rebooted, or applied to one of three hosts in a cluster.
• Audit confirms the process worked — that findings are being tracked, assigned, and closed within the timeframes policy requires.
• Verification is the human confirmation that the fix addressed the underlying problem, not just the symptom the scanner looked for. Changing a version banner makes a finding disappear and fixes nothing.

Two failure modes worth naming. A finding that disappears because the host stopped responding to the scanner reads exactly like a fix — so a drop in findings should always be checked against a stable asset count. And a finding that reappears after a rebuild, because the golden image was never updated, means the same work is being done every month; the fix belongs in the baseline.

Reporting, and where CySA+ takes this considerably further than SY0-701 does

Reporting turns scan output into something an organisation acts on, and different audiences need different reports:

• Technical teams need the finding, the affected hosts, the fix, and the deadline.
• Management needs trend and exposure: how many criticals are open, how long they stay open (mean time to remediate), whether the backlog is growing or shrinking, and which business areas carry the risk.
• Auditors and regulators need evidence that the process runs as documented — scan frequency, coverage, remediation timeframes met, exceptions approved.

The metrics that matter are about flow, not stock: how quickly findings are closed and whether that is improving. A report of total open vulnerabilities tells you almost nothing, because the number rises with better scanning coverage, which is a good thing being reported as a bad one.

Where this stops for SY0-701. CompTIA gives vulnerability management one objective here, and the exam tests the cycle, the terminology, the true/false positive/negative grid and the prioritisation reasoning above. CS0-004 — CySA+ — examines the same material as a substantial share of a whole exam, adding scanner configuration and tuning, deeper CVSS work, threat intelligence integration, detailed attack-surface analysis and formal reporting. If you want that depth it is a different certification, and our CySA+ course covers it. For SY0-701, this lesson is the scope.

What to take into the exam

• CVE names a vulnerability; CVSS scores it. The score is context-free.
• A false negative is the dangerous outcome, and non-credentialed scans produce them.
• Credentialed scans are more accurate; non-credentialed scans show external exposure. Use both for different questions.
• Prioritise by exposure, asset criticality and active exploitation — not by the severity column alone.
• Exceptions must be time-bounded, owned, and recorded in the risk register.
• Rescan to validate, and check that a drop in findings is not a host that stopped answering.