Security Operations · Topic 3 of 7
Vulnerability Analysis and Prioritization
Analyze scan results using CVE, CVSS, exploit data and asset context, validate false positives and choose remediation, mitigation or acceptance.
- 5 min
- Credentialed scans are more accurate than non credentialed scans.
- Agent based scans cover remote and roaming devices, passive scans suit fragile systems.
- CVE identifies a specific flaw, CWE identifies a weakness type, and CVSS rates severity.
What it is
Vulnerability analysis finds weaknesses, judges which ones matter and recommends what to do. Scanners produce long lists, and an architect's value is in deciding order and action, not in running the scan.
The aim is to reduce the attack surface, which is the sum of places an attacker can reach. Fixing everything is impossible, so decisions use risk: how bad, how likely, how exposed.
How it works
Scanning approaches
| Approach | How it works | Strength | Weakness |
|---|---|---|---|
| Unauthenticated (non credentialed) | Probes from outside, like an attacker | Shows what an outsider sees | Misses local issues, more false positives |
| Authenticated (credentialed) | Logs in to inspect patches and configuration | Accurate and detailed | Needs account management |
| Agent based | Software on the host reports to a console | Covers roaming and remote devices | Agent upkeep |
| Passive | Observes traffic to identify devices and software | Safe for fragile systems | Only sees what talks |
Scan on a schedule and after major changes. Include cloud, containers and applications. Static and dynamic application testing and software composition analysis cover code and libraries that network scanners miss.
Identifiers and scoring
The Common Vulnerabilities and Exposures (CVE) program gives each publicly known flaw a unique identifier. The Common Weakness Enumeration (CWE) lists types of weakness, such as improper input validation. The Common Vulnerability Scoring System (CVSS) rates severity from 0 to 10, with bands: low is 0.1 to 3.9, medium 4.0 to 6.9, high 7.0 to 8.9 and critical 9.0 to 10.0.
CVSS has a base score for the intrinsic features of the flaw, adjustments for current threat information such as the availability of exploit code, and environmental adjustments for your own setting. A base score alone ignores your context, so a critical score on a system that is not reachable may matter less than a medium score on an exposed one.
Adding exploit and context data
Good prioritization combines several inputs.
- Exploit evidence: is there public exploit code, or is it known to be used in attacks? The Exploit Prediction Scoring System (EPSS) estimates the probability of exploitation, and the Known Exploited Vulnerabilities (KEV) catalog from the Cybersecurity and Infrastructure Security Agency lists flaws that are confirmed as exploited.
- Exposure: internet facing, internal, or isolated.
- Asset criticality and data classification: what the system does and holds.
- Compensating controls: segmentation, web application firewall rules or endpoint protection that reduce real risk.
- Remediation effort and downtime: a fix that needs a long outage may call for a mitigation first.
Validating results
A false positive is a reported flaw that does not exist, perhaps because a patch was backported or the service is not reachable. A false negative is a real flaw that the scan missed.
Validate high impact findings by checking configuration, confirming versions or, with permission, a controlled test. A penetration test goes further than a scan by chaining weaknesses to show real impact.
Response options
| Option | When to use |
|---|---|
| Remediate | Patch, upgrade or reconfigure to remove the flaw |
| Mitigate | A fix is not possible yet, so reduce exposure with isolation, a firewall rule, a virtual patch or disabling the feature |
| Transfer | Shift financial impact with insurance or contract, with remaining accountability |
| Accept | Low risk or unavoidable, with a documented owner, rationale and review date |
Track findings to closure with deadlines based on priority, and verify with a rescan. Report on aging and recurrence, since the same finding returning points to a process problem such as a bad golden image.
Reducing the attack surface
Remove or disable unused services, close unneeded ports, limit exposed management interfaces, retire unsupported software and keep an accurate asset inventory. External attack surface management looks at your organization from the internet to find forgotten assets, such as old test servers and orphaned cloud resources. Shadow IT is a large source of unmanaged exposure.
What to remember for the exam
- Credentialed scans are more accurate than non credentialed scans.
- Agent based scans cover remote and roaming devices, passive scans suit fragile systems.
- CVE identifies a specific flaw, CWE identifies a weakness type, and CVSS rates severity.
- A base CVSS score ignores your environment, so adjust for exposure and criticality.
- Active exploitation evidence, from KEV or similar sources, raises priority sharply.
- Validate findings to separate false positives, and use a penetration test to show chained impact.
- When a patch is not possible, mitigate with isolation or virtual patching and record it.
- Unknown and forgotten assets are part of the attack surface.
When two findings have similar scores, choose the one that is internet facing and known to be exploited.
Common mistakes
Sorting by CVSS alone. The score does not know your exposure, data or controls.
Treating a scan as a penetration test. A scan lists possible flaws, and a test shows what an attacker can do with them.
Closing a ticket without rescanning. Only a rescan proves that the fix worked.
Scanning only known assets. Unknown systems stay unscanned and unpatched.
Active scans can disrupt fragile or legacy devices, so use passive methods or scheduled windows for them.
Check yourself
Work through these three questions.
Why prefer an authenticated scan?
It can inspect patches and configuration directly, so results are more accurate with fewer false positives.
What is the difference between CVE and CVSS?
A CVE is the identifier of a specific vulnerability, and CVSS is a score of its severity.
What should you do when a critical patch cannot be applied soon?
Apply a mitigation, such as isolation or virtual patching, and document it with an owner and review date.
Topic 3 of 7 in Security Operations
Test yourself on Security Operations
The full CompTIA SecurityX CAS-005 question bank has 654 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.