4.3 Explain various activities associated with vulnerability management
Domain 4: Security Operations
Vulnerability management on SY0-701 is a lifecycle: identify, analyze, respond, validate, and report. Know the identification methods — vulnerability scans, penetration testing, bug bounty programs, threat feeds, OSINT, dark web monitoring, and static or dynamic application analysis. Analysis is where most questions live: interpreting CVSS scores, understanding CVE identifiers, recognizing false positives and false negatives, and prioritizing based on exposure, environment, and organizational impact rather than raw score alone. On the response side, distinguish patching from compensating controls, and remediation from mitigation, acceptance, or an exception with documented approval. Validation means rescanning or auditing to confirm the fix actually worked. Candidates frequently treat CVSS as the whole answer; the exam rewards factoring in whether the system is internet-facing, what data it holds, and whether an exploit is active. Also keep credentialed versus non-credentialed scans straight — credentialed scans see more and produce fewer false positives — and know when an exception process is the correct, policy-driven answer.
What you must know
- vulnerability scanning types
- CVSS and CVE
- false positives vs negatives
- risk-based prioritization
- remediation vs compensating controls
- rescanning and validation
common pitfall · Candidates prioritize purely by CVSS score and miss that exposure, data sensitivity, and active exploitation should drive which vulnerability gets fixed first.
Try sample questions
A vulnerability scan identifies a critical flaw in a legacy application server that processes orders around the clock. The vendor has not released a patch, and the business will not approve downtime. Which of the following are the MOST appropriate compensating actions while awaiting a vendor fix? (Select TWO.)
- A Rescan the server daily until the vendor releases a patch
- B Move the server onto an isolated network segment with tightly restricted access
- C Uninstall the vulnerability scanning agent from the affected server
- D Mark the finding as a false positive so alerts stop generating
- E Apply firewall allow-list rules limiting inbound connections to the vulnerable service
Show answer & explanations
- A Daily rescanning only re-detects the same known flaw; it provides monitoring but does nothing to reduce the likelihood or impact of exploitation, so it is not a compensating control.
- B correct ·Network segmentation places the vulnerable server in an isolated segment, sharply limiting which systems can reach it and reducing the exposed attack surface until a patch becomes available.
- C Uninstalling the scanning agent removes visibility into the server's security posture and does nothing to protect the vulnerable service; it worsens the organization's ability to manage the risk.
- D The finding is confirmed and real; recording it as a false positive suppresses alerting and creates an inaccurate record, leaving the exposure unmanaged and undocumented for auditors.
- E correct ·Allow-list firewall rules that restrict inbound access to the vulnerable service reduce exploitability by permitting only known required traffic, a classic compensating control when patching is not possible.
sample item — the full bank runs 450+ questions at exam difficulty
A vulnerability scan reports a critical missing patch on a production server. The server administrator insists the patch was installed during last month's maintenance window. Which of the following should the security analyst do FIRST?
- A Confirm the patch level manually on the host to determine whether the finding is a false positive
- B Escalate the finding to management so it can be documented as an accepted risk
- C Remove the server from the scan scope so the alert no longer appears
- D Reimage the server from a known-good build to guarantee the flaw is remediated
Show answer & explanations
- A correct ·Manually verifying the installed patch level and configuration on the host confirms whether the scanner reported a false positive, which is the correct validation step before any remediation or escalation decision.
- B Risk acceptance is a deliberate management decision made after a finding has been validated and remediation options weighed; using it to close a disputed scan result skips validation entirely.
- C Removing the server from scan scope hides the finding instead of resolving it, leaving a potentially real critical vulnerability invisible to all future assessments of the environment.
- D Reimaging is a disruptive remediation that causes downtime and may be completely unnecessary; the administrator may be right that the patch is installed, so validation must come first.
Is objective 4.3 your weak spot?
The free readiness check finds your weakest objectives in 15 adaptive questions — then full access drills them until the gauge clears the cut line.
Check my readiness — free