CySA+ Domain 2 - Vulnerability Management (30%)¶

The second-largest domain. It is less about running a scanner and more about deciding what to fix first and proving the fix worked.

Scanning methods and concepts¶

• Asset discovery - finding what is on the network before scanning it. Scanning only known assets guarantees blind spots.
• Credentialed scan - the scanner authenticates to the target. Far more accurate, sees installed patch levels and configuration, produces fewer false positives.
• Non-credentialed scan - no authentication. Sees only what an unauthenticated attacker sees. Faster and less intrusive, but shallow.
• Agent-based scanning - software on the host reports continuously. Good for laptops that are rarely on the corporate network.
• Agentless scanning - the scanner reaches out over the network. No software to deploy, but requires network reachability and credentials.
• Active scanning - sends traffic to the target. Accurate but can disrupt fragile systems.
• Passive scanning - observes existing traffic. Zero impact, but incomplete.
• Static analysis (SAST) - examining source code without running it.
• Dynamic analysis (DAST) - testing a running application.
• Interactive application security testing (IAST) - instrumentation inside the running app, combining both views.
• Software composition analysis (SCA) - identifying third-party and open-source components and their known vulnerabilities.

Special considerations

• Scanning sensitivity levels - how aggressive the checks are. High sensitivity risks disrupting operational technology.
• Segmentation - a scanner cannot see across a segment it cannot route to, so segmented networks need distributed scanners.
• Operational technology (OT) and ICS/SCADA - often intolerant of active scanning. Passive methods are usually mandated.
• Regulatory requirements - PCI DSS mandates quarterly scans plus scans after significant change.

Analyzing vulnerability assessment output¶

• False positive - reported but not actually present. Wastes remediation effort and erodes trust in the tool.
• False negative - present but not reported. More dangerous, because it creates false assurance.
• True positive - correctly identified real vulnerability.
• Validation - confirming a finding is real, by manual testing or a second tool, before escalating it.
• CVE (Common Vulnerabilities and Exposures) - the unique identifier for a publicly known vulnerability.
• CWE (Common Weakness Enumeration) - the class of software weakness underlying the vulnerability, for example CWE-79 for cross-site scripting.
• CPE (Common Platform Enumeration) - a standard naming scheme for products, used to match assets to vulnerabilities.

Prioritization¶

The exam tests judgment here more than recall.

CVSS (Common Vulnerability Scoring System) produces a 0-10 severity score.

• Base score - intrinsic severity of the vulnerability, unchanging.
• Temporal score - adjusts for exploit maturity and remediation availability over time.
• Environmental score - adjusts for how much the affected asset matters in your environment.

CVSS alone is not prioritization. A CVSS 9.8 on an isolated test box matters less than a CVSS 7.5 on an internet-facing system holding cardholder data. Combine:

• Exploitability and weaponization - is there a working public exploit? Is it in active use? Sources such as CISA's Known Exploited Vulnerabilities catalog answer this.
• Asset value and criticality - what the system does for the business.
• Exposure - internet-facing versus internal only.
• Zero-day - a vulnerability with no vendor patch available. Requires compensating controls rather than patching.

Controls and mitigation¶

• Patching - the definitive fix, subject to testing and change control.
• Configuration management - hardening settings, often to a benchmark such as CIS.
• Compensating control - an alternative measure when the primary fix cannot be applied, for example a WAF rule in front of an unpatchable application.
• Risk acceptance - a documented decision to live with a risk, owned by someone with authority to accept it.
• Isolation, segmentation, and removal - reduce or eliminate exposure when patching is impossible.
• Insurance - transfers financial impact, not the risk itself.

Attack surface management is the ongoing discipline of finding and reducing exposure: edge discovery, passive discovery, security controls testing, penetration testing, and bug bounty programmes.

Vulnerabilities worth knowing by name¶

• Injection (SQL, command, LDAP) - untrusted input interpreted as code. Fix with parameterized queries and input validation.
• Cross-site scripting (XSS) - attacker script executes in another user's browser. Reflected, stored, and DOM-based variants.
• Cross-site request forgery (CSRF) - a victim's browser is tricked into submitting an authenticated request. Fix with anti-CSRF tokens.
• Server-side request forgery (SSRF) - the server is tricked into making requests on the attacker's behalf, often to reach cloud metadata endpoints.
• Insecure direct object reference (IDOR) - access control missing on an object identifier.
• Privilege escalation - moving from lower to higher rights, vertically or horizontally.
• Race condition and TOCTOU - a check and its use are separated in time, and state changes in between.
• Buffer overflow - writing past an allocation boundary to corrupt memory.
• Broken authentication and session hijacking - stolen or predictable session identifiers.
• Supply chain vulnerability - a compromised dependency or vendor component.

Verification and reporting the loop closed¶

• Rescanning - the primary proof that remediation worked.
• Audit and verification - independent confirmation, sometimes required by regulation.
• Remediation SLAs - agreed timelines by severity. The metric that shows whether the program is functioning.
• Maintenance windows - agreed periods for disruptive changes.
• Inhibitors to remediation - MOUs, SLAs, business process interruption, degrading functionality, legacy and proprietary systems. The exam expects you to recognize these as legitimate constraints rather than excuses.

Exam pointers¶

• If a question mentions false positives and asks how to reduce them, the answer is usually credentialed scanning.
• If a question involves ICS/SCADA or medical devices, prefer passive scanning.
• Prioritization questions almost never resolve to "highest CVSS." Look for exposure, exploit availability, and data sensitivity.
• After remediation, the way you prove it is a rescan.

Official documentation¶

📖 CompTIA CySA+ exam objectives - authoritative domain list 📖 NVD CVSS calculator - score the metrics yourself 📖 CISA Known Exploited Vulnerabilities catalog - what is actually being exploited 📖 OWASP Top 10 - common web application risks