Security Operations · Topic 7 of 14
Vulnerability Management Tasks
Security+ vulnerability management: scanning, IPAM, CSPM and code review, severity and pen test review, remediation, verification and disclosure.
- 5 min
- Identification methods are scanning, IPAM, CSPM and source code review.
- Credentialed scans see more than non-credentialed scans.
- Prioritize with severity assessment plus context: exposure, exploitability, asset value and business impact.
What it is
Vulnerability management is the continuing process of finding weaknesses, deciding which matter most, fixing or reducing them, confirming the result and reporting it.
It is a cycle, not a one time scan. New flaws are announced every day, and systems change constantly.
How it works
Identification methods
| Method | What it provides |
|---|---|
| Scanning | Automated checks of systems for known flaws, missing patches and misconfigurations |
| Internet Protocol Address Management (IPAM) | A central record of address use, which reveals devices that nobody registered and gaps in scan coverage |
| Cloud security posture management (CSPM) | Continuous checks of cloud settings against policy, such as storage open to the public or logging turned off |
| Source code review | Manual or tool-assisted reading of code to find flaws before release |
A scan can be credentialed, where the scanner logs in and sees installed software and settings, or non-credentialed, where it sees only what an outsider sees. Credentialed scans find more and produce fewer false results.
A scanner can only check addresses it knows about. IPAM data shows which address ranges are in use, so unknown hosts can be added to the scan scope.
Prioritization
A scanner result is not automatically true or important. Each finding is checked and ranked.
| Concept | Meaning |
|---|---|
| Severity assessment | Rating how serious a flaw is, usually starting from its Common Vulnerability Scoring System (CVSS) score and adjusting for local context |
| Penetration test report review | Reading the findings of an authorized test that tried to exploit weaknesses, which shows real impact and attack paths |
| False positive | The tool reports a flaw that does not exist |
| False negative | A real flaw is missed |
The CVSS score runs from 0 to 10, with bands Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9) and Critical (9.0 to 10.0). The score is a starting point, not the final priority.
Context changes priority. A high score on a system that is not reachable may matter less than a medium score on an internet-facing server that holds sensitive data. Consider how exploitable the flaw is, whether exploits are in use, how important the asset is and the business impact.
A penetration test report often chains small flaws into one serious path. Reviewing it means checking each finding, its proof and its recommended fix, then assigning owners and dates.
Remediation
| Option | Use |
|---|---|
| Patching | Apply the vendor fix |
| Configuration change | Correct a misconfiguration, such as a public storage bucket |
| Segmentation or isolation | Limit access to a system that cannot be fixed yet |
| Compensating controls | Add other protections when the flaw cannot be fixed |
| Exception | Formally accept a risk for a defined reason and period |
An exception should be documented, approved and time limited, with compensating controls where possible. Patches should go through change management and be tested when time allows.
Verification
After remediation, verify that the fix worked. This uses a rescan with the same tool, a retest of a penetration test finding or a direct check of the system. A patch that failed to install looks the same as one that worked until it is checked.
Reporting
| Type | Audience and content |
|---|---|
| Internal reporting | Technical staff get lists of findings and fixes. Managers get trends, risk and progress against targets |
| External: bounty program | Outside researchers are invited to find flaws within defined rules and are paid for valid reports |
| External: responsible disclosure policy | A published policy that tells researchers how to report a flaw, what testing is allowed and how the organization will respond |
A responsible disclosure policy gives researchers a safe way to report flaws and gives the organization time to fix them before details are made public. A bounty program adds a reward.
How the exam asks about this
- "A cloud storage bucket was made public without anyone noticing." -> Cloud security posture management.
- "A patch cannot be applied to a legacy controller." -> Isolation or a compensating control with a documented exception.
- "The team must confirm last week's fix closed the flaw." -> Verification with a rescan.
What to remember for the exam
- Identification methods are scanning, IPAM, CSPM and source code review.
- Credentialed scans see more than non-credentialed scans.
- Prioritize with severity assessment plus context: exposure, exploitability, asset value and business impact.
- A penetration test report shows real attack paths and must be reviewed and assigned.
- Remediation options include patching, configuration changes, segmentation, compensating controls and exceptions.
- Verify every fix with a rescan or retest.
- Internal reports go to staff and managers. Bounty programs and responsible disclosure policies handle outside reports.
When a scenario says a patch cannot be applied, look for segmentation or a compensating control, plus a documented exception.
Common mistakes
Fixing only the highest score. A moderate flaw on a critical, exposed system may deserve first attention.
Trusting every scanner result. Always confirm results, since false positives waste time and false negatives leave gaps.
Scanning only known addresses. Devices missing from IPAM or the inventory are never scanned.
Skipping verification. Without a rescan, a failed fix goes unnoticed.
Treating a penetration test as a scan. A scan lists possible flaws, while a penetration test tries to exploit them to show impact.
An exception that never expires becomes a permanent hole. Set a review date and recheck the risk.
Check yourself
What does CSPM do?
It continuously checks cloud configurations against policy and flags misconfigurations such as public storage.
Why are credentialed scans preferred?
The scanner logs in and sees installed software and settings, so it finds more flaws with fewer false results.
What is the purpose of a responsible disclosure policy?
It tells outside researchers how to report flaws safely and how the organization will respond.
Topic 7 of 14 in Security Operations
Test yourself on Security Operations
The full CompTIA Security+ SY0-801 question bank has 998 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.