CompTIA Security+ Preparation · lesson 12 of 45 · 25 min
What Is Vulnerability Management?
A vulnerability is a weakness in a system, application, or process that could be exploited by a threat actor to cause harm. Vulnerability management is the continuous process of identifying, classifying, prioritizing, remediating, and verifying vulnerabilities across an organization’s attack surface.
The Security+ exam tests your understanding of the vulnerability management lifecycle, scanning types, scoring systems (CVSS), and the difference between vulnerability scanning and penetration testing.
Vulnerability vs Threat vs Risk
Vulnerability — a weakness (e.g. unpatched Apache server).Threat — a potential danger that could exploit the vulnerability (e.g. ransomware group).Risk — the likelihood and impact of the threat exploiting the vulnerability.Risk = Threat × Vulnerability × Impact
Vulnerability Management Lifecycle
Scanning Types
Credentialed vs non-credentialed
Credentialed scans are far more thorough — they can check installed patch levels, registry settings, and local configurations. Non-credentialed scans only see open ports and services. For compliance assessments (PCI-DSS, HIPAA), credentialed scans are typically required.
CVSS — Common Vulnerability Scoring System
The CVSS (currently v3.1 / v4.0) is the industry-standard system for scoring the severity of vulnerabilities on a 0–10 scale. It helps organizations prioritize which vulnerabilities to fix first.
CVSS scores are calculated from three metric groups: Base (intrinsic characteristics — attack vector, complexity, privileges required, impact), Temporal (exploit maturity, patch availability), and Environmental (asset criticality in your specific environment). The Base score is published by the vendor/NVD; Temporal and Environmental are customized by the organization.
CVE and NVD
A CVE (Common Vulnerabilities and Exposures) is a unique identifier for a publicly known vulnerability — e.g. CVE-2021-44228 (Log4Shell). The NVD (National Vulnerability Database) enriches CVE entries with CVSS scores, affected products, and remediation guidance. Vulnerability scanners map their findings to CVE IDs so you can look up details and patches.
Vulnerability Scanning vs Penetration Testing
Flashcard Drill
CVE Common Vulnerabilities and Exposures — unique identifier for a publicly known vulnerability. CVSS Common Vulnerability Scoring System — 0–10 scale for vulnerability severity. NVD National Vulnerability Database — enriches CVEs with CVSS scores and remediation guidance. Credentialed scan Vulnerability scan using valid credentials — more thorough; sees installed patches and configs. Non-credentialed scan Vulnerability scan without credentials — external attacker perspective; less detail. CVSS Critical Score 9.0–10.0 — emergency patch required within 24–72 hours. Penetration test Authorized attempt to exploit vulnerabilities to demonstrate real-world impact — requires written permission. False positive Scanner reports a vulnerability that does not actually exist — wastes remediation effort. False negative Scanner misses a real vulnerability — dangerous gap in coverage. Attack surface The total set of points where an attacker could try to enter or extract data from an environment.
Scenario Practice
Prioritizing the Patch Queue
Patch the 635 medium/low findings first — there are more of them. Patch the 200 Follina workstations first — more systems are affected. Patch the 12 Log4Shell internet-facing servers first — Critical CVSS 10.0 on internet-exposed assets. Ignore all findings until the next scheduled maintenance window. 2 CVSS 10.0 Critical on internet-facing servers is the highest risk. Internet exposure means attackers can reach these systems directly. Always prioritize by: severity × exposure × asset criticality. The 12 Log4Shell servers must be patched first.
Scan Type Selection
Run non-credentialed external scans — they simulate the attacker view. Run credentialed internal scans — they provide the most accurate view of patch levels and configurations. Run passive scans only — they have zero impact on production systems. Use a penetration test instead — it is more thorough. 1 PCI-DSS requires credentialed scans for accurate compliance assessment. Credentialed scans check actual patch levels and configurations. Non-credentialed scans miss internal vulnerabilities. Passive scans don’t actively probe. Pen tests are separate from compliance scans.
Knowledge Check
Vulnerability Scanning — 10 Questions
A CVSS score of 9.5 indicates which severity level?
- High
- Medium
- Critical
- Low
Answer: Critical
CVSS 9.0–10.0 is Critical — requires emergency patching within 24–72 hours.
Which scan type provides the most accurate view of installed patches and system configurations?
- Non-credentialed
- Passive
- Credentialed
- External
Answer: Credentialed
Credentialed scans log in with valid credentials and can inspect installed software, registry, and patch levels directly.
A penetration test and a vulnerability scan have the same goal and output.
- True
- False
Answer: False
A vulnerability scan lists vulnerabilities. A penetration test exploits them to demonstrate real impact — different goals, depth, and outputs.
The unique identifier assigned to each publicly known vulnerability is called a _____.
Answer: CVE
CVE (Common Vulnerabilities and Exposures) provides a unique ID for each known vulnerability.
A scanner reports a vulnerability on a system that has actually already been patched. This is called a:
- False negative
- True positive
- False positive
- True negative
- Answer: False positive
A false positive is when the scanner incorrectly reports a vulnerability that does not exist (or has been remediated).
Which CVSS metric groups are used to calculate a vulnerability score? (Select all that apply)
- Base
- Temporal
- Environmental
- Operational
- Physical
Answer: Base
Temporal
Environmental CVSS uses Base (intrinsic), Temporal (exploit maturity), and Environmental (asset context) metric groups.
Which phase of the vulnerability management lifecycle confirms that a remediation was effective?
- Scan
- Analyze
- Verify
- Report
Answer: Verify
The Verify phase re-scans or tests to confirm the vulnerability was successfully remediated.
An agent-based vulnerability scanner is best suited for:
- External internet-facing systems
- Remote or offline assets that cannot be reached by network scans
- Passive traffic monitoring
- One-time assessments
- Answer: Remote or offline assets that cannot be reached by network scans
Agent-based scanners install software on each host and report locally — ideal for remote workers, offline systems, or cloud workloads.
A penetration test requires written authorization before it begins.
- True
- False
Answer: True
Penetration testing without written authorization is illegal — it is unauthorized access regardless of intent.
The NVD enriches CVE entries with which additional information?
- Exploit code only
- CVSS scores, affected products, and remediation guidance
- Threat actor attribution
- Firewall rules
Answer: CVSS scores, affected products, and remediation guidance
The NVD (National Vulnerability Database) adds CVSS scores, affected product lists, and remediation references to CVE entries.
Previous lesson: Threat actors: nation-state, insider, hacktivist, criminal
Back to CompTIA Security+ Preparation
Next lesson: Attack surface and attack vectors: network, application, supply chain, human