CySA+ · Domain 2
Vulnerability Management
About 26% of the exam
Scan types
- Credentialed
- logs in, sees real versions
- Non-credentialed
- outside view, more guessing
- Agent based
- works on roaming laptops
- Agentless
- nothing installed, needs network reach
- Active
- sends probes at the target
- Passive
- watches traffic, never probes
- Internal
- what an insider could reach
- External
- what the internet can see
- Static
- reads code without running it
- Dynamic
- tests the running application
Planning the scan
- Scope from an accurate asset inventory
- Schedule around business peak hours
- Tune sensitivity for fragile devices
- Place scanners close to their targets
- Regulated systems have mandated frequency
- Never scan operational technology aggressively
- Watch scanner and log source health
Tools by job
- Nmap
- host discovery and port scanning
- Nessus, OpenVAS
- infrastructure vulnerability scanning
- Burp, ZAP
- web application testing proxies
- Nikto
- quick web server checks
- Metasploit
- validates exploitability under control
- Scout Suite, Prowler
- cloud configuration assessment
- Recon-ng, Maltego
- open source reconnaissance
- Debugger
- step through the binary
Validating the finding
- True positive
- real, confirmed, needs work
- False positive
- reported but not real
- True negative
- correctly reported as clean
- False negative
- missed, the dangerous one
- Confirmation
- rescan with credentials
- Compensating control
- risk covered another way
- Exception
- accepted, dated and owned
- Reconciliation
- compare against the asset list
Reading a CVSS score
Base exploitability
- Attack vector: network worst, physical best
- Low attack complexity is worse
- No privileges required is worse
- No user interaction is worse
- Changed scope crosses a security boundary
Severity bands
- None sits at 0.0
- Low is 0.1 to 3.9
- Medium is 4.0 to 6.9
- High is 7.0 to 8.9
- Critical is 9.0 to 10.0
Beyond the base
- Temporal reflects patch and exploit maturity
- Environmental reweights for your estate
- EPSS estimates exploitation probability
- KEV lists confirmed exploited vulnerabilities
CVSS measures severity, not risk: combine it with exposure, exploit availability and asset value before ranking anything
Vulnerability classes to recognize
Injection and execution
- SQL injection, cured by parameterized queries
- Cross-site scripting, reflected or persistent
- Remote code execution from unsafe input
- File inclusion, local or remote
- Server-side request forgery reaches internal services
Access and session
- Broken access control, missing authorization check
- Directory traversal escapes the web root
- Request forgery rides the victim session
- Privilege escalation through misconfiguration
- Authentication failures and reusable credentials
Design and configuration
- Cryptographic failures, weak or missing encryption
- Misconfiguration and default credentials
- Insecure design with no threat modeling
- End of life components nobody patches
- Buffer, heap, stack and integer overflow
Prioritizing for real
- Internet facing beats internal every time
- Public exploit code raises urgency
- Confirmed exploitation outranks a higher score
- Asset criticality changes the ranking
- Isolated systems can wait longer
- Chained medium findings become critical
- Data sensitivity drives the deadline
Response options
- Patch
- the preferred permanent fix
- Configuration change
- close it without a patch
- Segmentation
- reduce who can reach it
- Compensating control
- monitoring or virtual patching
- Accept
- documented, owned, time-bound
- Transfer
- insurance or contractual shift
- Avoid
- retire the affected service
- Awareness
- training when people are the gap
Patch management
- Pilot test
- Approve the change
- Schedule a window
- Deploy in phases
- Rescan to validate
- Roll back if needed
- Emergency patching still leaves a record
- Write the rollback before deploying
- Validation means rescanning, not assuming
- Every exception carries an expiry date
Secure coding controls
- Input validation
- allow list, on the server
- Output encoding
- neutralize scripts in responses
- Parameterized queries
- separate code from data
- Session management
- rotate at login, expire idle
- Authentication
- strong, throttled and multi-factor
- Data protection
- encrypt and store less
- Error handling
- reveal nothing about internals
- Dependency hygiene
- track components with an SBOM
Attack surface management
- Discover the edge before attackers do
- Passive discovery finds forgotten assets
- Bug bounty extends your testing reach
- Adversary emulation tests real techniques
- Retire services nobody uses
- Reduce first, then monitor what remains
Awkward environments
- OT and ICS
- safety and availability come first
- SCADA scanning
- passive only, agreed windows
- Cloud
- scan configuration, not only hosts
- Containers
- scan the image in the pipeline
- Serverless
- review code, permissions and triggers
- Mobile
- platform version and side loading
- IoT
- fragile stacks crash under scanning
Program metrics
- Scan coverage
- share of assets actually scanned
- Time to remediate
- clock starts at discovery
- SLA compliance
- fixed inside the agreed window
- Vulnerability density
- findings per asset over time
- Recurrence rate
- the same finding coming back
- Open exceptions
- accepted risk still outstanding
Rapid recall
- CVE
- the identifier for one flaw
- CVSS
- the severity score
- CWE
- the underlying weakness class
- EPSS
- probability of exploitation soon
- KEV
- catalog of exploited vulnerabilities
- SBOM
- inventory of software components
- SAST
- static analysis of source
- DAST
- dynamic testing while running
Reference strip: scan, score, fix, prove
Scan
- Credentialed versus non-credentialed
- Agent, agentless, active, passive
- Internal, external, cloud, container
- Static, dynamic, interactive, fuzzing
Score
- CVSS base, temporal, environmental
- Severity bands from low to critical
- EPSS probability and KEV catalog
- Exposure, exploitability, asset value
Classes
- Injection, scripting, traversal, forgery
- Broken access control and authentication
- Cryptographic failure and misconfiguration
- Overflow, race condition, insecure design
Fix
- Patch, reconfigure, segment, compensate
- Accept, transfer or avoid with a record
- Maintenance windows and rollback plans
- Secure coding and dependency hygiene
Frameworks
- PCI DSS scanning requirements
- CIS benchmarks for baselines
- OWASP for application testing
- ISO 27000 series for the program
Quick exam traps
- Trap: A CVSS 10 always outranks every other finding
- Trap: A non-credentialed scan gives the complete picture
- Trap: A false positive is worse than a false negative
- Trap: Patching alone closes every reported finding
- Trap: Scanning industrial controllers is safe with default settings
- Trap: An accepted risk needs no owner or expiry
- Trap: The rescan can be skipped once the ticket closes
- Trap: Container images inherit the host scan results
cybercertprep.com · original revision sheet written from the public body of knowledge