Back to CompTIA Cybersecurity Analyst+ (CySA+)

Vulnerability Management

Conduct vulnerability assessments, prioritize vulnerabilities, and recommend effective mitigation strategies for vulnerability management.

Covers implementing vulnerability scanning including asset discovery, internal vs. external scanning, agent vs. agentless approaches, credentialed vs. non-credentialed scans, passive vs. active scanning, static vs. dynamic analysis, and critical infrastructure scanning. Includes analyzing assessment tool output from network scanners, web application scanners, vulnerability scanners, debuggers, and cloud infrastructure assessments. Also covers vulnerability prioritization using CVSS, validation, exploitability assessment, and recommending mitigation controls.
5 minutes 5 Questions

In the context of the CompTIA CySA+ certification, Vulnerability Management is the cyclical practice of identifying, classifying, prioritizing, remediating, and mitigating software and infrastructure vulnerabilities. It moves beyond simple scanning to establish a comprehensive governance structure …

Concepts covered: Asset discovery and inventory, Internal vs. external vulnerability scanning, Agent-based vs. agentless scanning, Credentialed vs. non-credentialed scanning, Passive vs. active vulnerability scanning, Static vs. dynamic analysis, Critical infrastructure scanning, Network scanning tool output analysis, Web application scanner results, Vulnerability scanner output interpretation, Debugger and code analysis tools, Multipurpose security tools, Cloud infrastructure assessment, Common Vulnerability Scoring System (CVSS), Vulnerability validation and verification, Exploitability assessment, Asset value and criticality, Zero-day vulnerability handling, Cross-site scripting (XSS) mitigation, Buffer overflow vulnerability mitigation, SQL injection prevention, Data poisoning attack mitigation, Input validation controls, Compensating controls implementation, Patch management processes, Configuration management for security, Maintenance windows and change control, Exception handling and risk acceptance, Governance and compliance requirements, Service-level objectives (SLOs), Secure Software Development Life Cycle (SDLC), Threat modeling methodologies

Test mode:
Start practice test
CySA+ - Vulnerability Management Example Questions

Test your knowledge of Vulnerability Management

Question 1

A security architect is evaluating the integration of Software Composition Analysis (SCA) tools within a mature Secure SDLC pipeline. The organization currently runs SCA scans during the build phase, which identifies vulnerable third-party dependencies after developers have already integrated them into the codebase. Development teams complain about the disruption caused by having to replace dependencies late in the sprint cycle. Which architectural modification to the SCA integration would MOST effectively address this workflow friction while maintaining comprehensive dependency security?

Correct Answer: Implement SCA validation during dependency declaration in manifest files before build execution, combined with a pre-approved dependency catalog maintained by the security team

The correct answer involves implementing SCA validation during dependency declaration in manifest files before build execution, combined with a pre-approved dependency catalog maintained by the security team.

This approach most effectively addresses the workflow friction because:

  1. Shift-Left Strategy: By validating dependencies at the manifest file level (such as package.json, pom.xml, requirements.txt), security checks occur at the earliest possible point - when developers are selecting and declaring dependencies, not after integration.

  2. Pre-Approved Catalog: A curated catalog of vetted dependencies allows developers to make secure choices proactively. They can select from known-safe components, preventing vulnerable dependencies from ever entering the codebase.

  3. Reduced Sprint Disruption: Since validation happens before developers invest time in integration work, they can choose alternative dependencies early without reworking code.

  4. Proactive vs. Reactive: This shifts security from a blocking mechanism to an enabling one.

The option suggesting automated dependency updates during the build phase is problematic because automatically replacing dependencies can introduce breaking changes, compatibility issues, and untested code paths - this creates significant risk and doesn't give developers control over remediation.

The option proposing pull request gates with training still operates too late in the development cycle. While PR gates are valuable, developers have already written code by that point, so they still face the same late-stage replacement issue the organization is trying to solve.

The option suggesting CI phase scanning with parallel scanning of source and compiled artifacts represents the current state or even later-stage scanning. This doesn't address the core problem - it still catches issues after integration, causing the sprint disruption that development teams are complaining about.

Question 2

During a quarterly security review, a CySA+ analyst identifies that multiple emergency changes were implemented over the past 90 days, with several bypassing the standard change advisory board approval process. The analyst notes that 40% of these emergency changes resulted in subsequent incidents requiring rollback. Which recommendation would most effectively address this pattern while balancing operational needs with governance requirements?

Correct Answer: Implement a streamlined emergency change process that requires documented risk assessment and post-implementation review within 48 hours

The correct answer is to implement a streamlined emergency change process that requires documented risk assessment and post-implementation review within 48 hours.

This recommendation effectively addresses the identified pattern for several key reasons:

  1. Balances Speed with Governance: Emergency changes exist because organizations need to respond quickly to urgent situations. A streamlined process acknowledges this operational reality while still maintaining appropriate controls.

  2. Risk Assessment Requirement: By mandating documented risk assessment, the organization ensures that even urgent changes receive proper consideration of potential impacts. This addresses the root cause of the 40% failure rate - changes being made hastily with inadequate evaluation.

  3. Post-Implementation Review: The 48-hour review requirement creates accountability and enables the organization to identify issues quickly, learn from mistakes, and improve future emergency change decisions. This is a core principle of continuous improvement in change management.

  4. Practical Implementation: This approach is realistic and achievable, unlike solutions that would delay emergency response capabilities.

The other options have significant drawbacks:

  • Requiring full CAB approval before implementation defeats the purpose of emergency changes entirely. When urgent security incidents or critical outages occur, waiting for the next scheduled CAB meeting could result in extended downtime, security breaches, or significant business impact.

  • Automated approval based solely on requestor role and asset classification removes human judgment from the process. This could lead to inappropriate changes being approved automatically, potentially increasing the failure rate rather than reducing it.

  • Pre-approving change categories during annual planning is too inflexible for the dynamic nature of emergency situations. Security threats and operational needs evolve throughout the year, making it impossible to accurately predict and pre-authorize all legitimate emergency change scenarios.

Question 3

A security division is attempting to reduce the noise of theoretical vulnerabilities by prioritizing risks based on the specific capabilities and motivations of likely threat actors. The team utilizes a methodology that pre-screens risks by establishing a library of established agents, scoring them on objectives and resources, and then mapping them to probable attack vectors. Which framework utilizes this distinct agent-centric taxonomy to filter the threat landscape?

Correct Answer: Threat Agent Risk Assessment

More Vulnerability Management questions
649 questions (total)
Start 100 question test