Study Hub / CompTIA CySA+ (CS0-004) / Domain 2.0
CompTIA CySA+ (CS0-004) Domain 2.0: Vulnerability Management — Explained
Domain 2.0 is the lifecycle of known weaknesses: finding them with scanners, prioritizing the pile (because you can't fix everything), remediating in the right order, and proving it worked. Scanning finds; analysis decides; remediation fixes.
Scanning: finding the weaknesses
- Vulnerability scanners — probe systems against databases of known CVEs (Nessus, Qualys, OpenVAS): missing patches, misconfigurations, weak settings. Credentialed scans (with logins) see far more than uncredentialed network scans.
- Scan types — network (what's exposed), agent-based (installed agent, continuous, sees offline gaps), web application (OWASP-style: injection, XSS), container/image (vulnerable packages in images).
- Scan hygiene — schedule off-hours (scans are noisy and occasionally disruptive), keep scanner plugins updated (stale scanner = stale findings), and get authorization — scanning you don't own permission for is indistinguishable from attacking.
- False positives in scans — scanners flag things that aren't actually exploitable (backported patches are the classic: version looks old, fix is backported). Validate before panicking.
Prioritization: what to fix first
- CVSS — the severity score (0–10): base metrics (attack vector, complexity, privileges, user interaction), temporal (exploit maturity), environmental (your context). A 9.8 that isn't exploitable in your environment may rank below a 7.5 that is.
- Beyond the score — exploitability (is there public exploit code?), asset criticality (internet-facing production vs. lab), exposure (reachable from untrusted networks?), and business context. Risk = severity × exploitability × asset value.
- Prioritization frameworks — keep it simple: critical + exploitable + exposed = fix now; everything else scheduled by risk rank. The exam rewards "patch the internet-facing critical first" thinking.
- Risk exceptions — when you can't fix (legacy system, vendor patch pending): document, get sign-off, apply compensating controls, set a review date. "Accepted risk" is a decision with a paper trail, not neglect.
Remediation and validation
- Remediation options — patch (the real fix), reconfigure (disable the vulnerable feature), compensating control (WAF rule, network segmentation while awaiting a patch), accept (documented risk acceptance).
- Change control — patches go through testing and scheduled windows, not straight to production Friday afternoon. Emergency changes exist for critical exploitation — with extra sign-off, not zero process.
- Secure baselines — hardened standard configs (CIS benchmarks): every system starts compliant, and drift gets corrected. Vulnerability management prevents future findings, not just fixes current ones.
- Validation — rescan to confirm the fix, verify the service still works, and close the finding with evidence. "Patched" without verification is a hope, not a fact.
- Reporting — trend it: mean time to remediate, % of criticals patched in SLA, recurring findings (which indicate broken processes, not bad luck).
The must-memorize table: remediation options
When each response fits.
| Option | Meaning | Use when |
|---|---|---|
| Patch | Apply the vendor fix | Available and tested — the real fix |
| Reconfigure | Disable/harden the vulnerable feature | Feature isn't needed; patch unavailable |
| Compensating control | Reduce exposure without fixing | Patch pending; e.g., WAF rule, segmentation |
| Risk acceptance | Document and accept | Fix impossible/impractical; sign-off + review date |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. A scan reports 500 criticals. The analyst finds the top 10 are internet-facing servers with public exploit code available. What should remediation prioritize?
- A. A. Alphabetical order — fairness matters
- B. B. The internet-facing, publicly-exploitable criticals first — highest risk = severity × exploitability × exposure
- C. C. The oldest findings first regardless of context
- D. D. Internal lab systems — they're easiest to patch
Show answer & reasoning
B. Prioritization is risk-based, not alphabetical or age-based: critical severity plus public exploits plus internet exposure is the worst combination and goes first. CVSS alone doesn't decide — exploitability and exposure complete the picture.
2. A scanner flags Apache 2.4.41 as vulnerable, but the vendor backported the security fix without changing the version number. What is this finding?
- A. A. A true positive — patch immediately
- B. B. A false positive from version-based detection — validate before acting
- C. C. Proof the scanner is broken
- D. D. A zero-day vulnerability
Show answer & reasoning
B. Backported patches are the classic scanner false positive: the version looks vulnerable but the fix is in. Validate (check the actual patch level/changelog) instead of "fixing" what isn't broken. Scanners report possibilities; analysts confirm realities.
3. A legacy control system can't be patched and the vendor has no fix planned. The team documents the risk, gets executive sign-off, segments the network around it, and sets a 6-month review. What is this?
- A. A. Negligence
- B. B. Risk acceptance with compensating controls — a documented decision, not neglect
- C. C. A vulnerability scan
- D. D. An incident response
Show answer & reasoning
B. When fixing is impossible, the professional path is: document, get sign-off, reduce exposure (segmentation), set a review date. That's risk management. Pretending the vuln doesn't exist (A) is the negligent version of the same facts — the paper trail is the difference.
4. After emergency patching, what must happen before the finding is closed?
- A. A. Nothing — patching is the finish line
- B. B. Validation: rescan to confirm remediation and verify the service still works
- C. C. Delete the scan reports
- D. D. Immediately scan a different subnet
Show answer & reasoning
B. Remediation isn't done until it's verified: rescan confirms the vulnerability is actually gone, and a functionality check confirms the patch didn't break the service. Closing on "we ran the patcher" confuses effort with outcome. Evidence closes findings.
This was one domain. The simulator drills all 4.
This free preview covered Vulnerability Management (Domain 2.0, 26%). Not covered here: Reporting and Communication (Domain 4.0, 16%). The reporting and communication domain plus advanced vulnerability-management and threat-hunting detail stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full CySA+ Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy