CS0-004 vulnerability management explained
Vulnerability Management is 26% of CS0-004, the second-largest domain. It has four objectives (2.1 to 2.4): choosing the right scanning method, analysing scanner output, prioritising and mitigating, and the control, risk and compliance concepts around the process. The recurring skill is judgement: a scanner reports hundreds of findings and the analyst decides which matter first and why.
The objective summaries are on CompTIA’s CySA+ V4 page. The sections below follow them in plain terms.
2.1 Choosing the scanning method
The objective is about tools and techniques for systems, networks and applications. The decision is a match between target and method.
| Choice | Meaning | When it fits |
|---|---|---|
| Credentialed (authenticated) | Scanner logs in and reads configuration and patch state | Accurate patch and configuration findings, fewer false positives |
| Non-credentialed | Scanner sees only what a network attacker sees | External view, finding exposed services |
| Agent-based | Software on the host reports to a console | Laptops and remote systems that are rarely on the network |
| Active | Probes targets directly | Fresh results; can disturb fragile systems |
| Passive | Observes traffic | Sensitive or operational technology environments |
| Application testing | Static analysis of code, dynamic testing of a running app | Web and API weaknesses that network scanners miss |
A scan is also a scheduling decision: scope, frequency, maintenance windows and the effect on production. A scan that crashes a fragile system has failed even if it found something.
2.2 Analysing scanner output
Output is evidence, not truth. The analyst checks each finding.
- False positive. The scanner reports a flaw that is not present, often because a fix was applied in a way the check cannot see, or because the version string was misread. Confirm with another source before dismissing.
- False negative. A real flaw the scan missed, for example because the scan was non-credentialed or the asset was out of scope.
- Context. Does the vulnerable service run, is it reachable, is there a compensating control?
- Correlation. Combine findings with asset inventory, previous scans and threat intelligence.
Identifiers are worth knowing: CVE names a specific vulnerability, CWE names a class of weakness, and CVSS scores severity. CVSS 3.x has base, temporal and environmental metric groups; CVSS 4.0 renames temporal to threat and adds supplemental metrics. The base score (attack vector, complexity, privileges, user interaction, impact on confidentiality, integrity and availability) is a property of the flaw, and the environmental group adjusts it for the organisation. Vulnerability management and CVSS explains how they differ.
2.3 Prioritising and mitigating
The summary names risk-based approaches using scoring systems, threat intelligence and business context. Severity alone is not priority.
| Input | What it adds |
|---|---|
| CVSS base score | Technical severity of the flaw |
| Exploit evidence | Whether exploitation is happening; the CISA Known Exploited Vulnerabilities catalogue lists flaws seen exploited in the wild |
| EPSS | A probability estimate that a flaw will be exploited soon |
| Asset criticality | What the system does for the business |
| Exposure | Internet-facing, internal only, segmented |
| Compensating controls | Whether something already blocks the attack path |
| Software bill of materials (SBOM) | Which components an application contains, so a newly disclosed library flaw can be matched to affected software |
Mitigation options are patching, a configuration change, a compensating control (virtual patching, segmentation, disabling a feature), or documented acceptance of the risk by someone with the authority to accept it. Patching has process too: test, schedule, deploy, then verify with a rescan. NIST SP 800-40 describes enterprise patch management.
2.4 Control types, risk and compliance
This objective covers controls, policies and compliance. Controls are classified by function (preventive, detective, corrective, compensating) and by category (technical, managerial, operational, physical); the security control categories page covers the vocabulary. Risk responses are mitigate, transfer, avoid or accept. Compliance means a regulation or contract may fix scan frequency or remediation deadlines, which then overrides purely technical preference.
Worked mini-scenario
A scan lists a critical-rated flaw on an internal print server and a medium-rated flaw on an internet-facing web server. The medium flaw is on the CISA KEV catalogue, and a public exploit exists. The web server is fixed first: it is exposed and actively exploited, while the print server is internal and has no known exploitation. The print server is scheduled normally and tracked.
Easy to confuse
- Vulnerability, threat and risk. A vulnerability is a weakness, a threat is something that can exploit it, risk combines likelihood and impact.
- Severity and priority. Severity is a property of the flaw; priority is what to fix first in this environment.
- Vulnerability scan and penetration test. A scan identifies and lists; a penetration test attempts exploitation to prove impact.
- Compensating control and accepted risk. The first reduces the risk; the second documents that it remains.
Exam-style pitfall: answering “patch the highest CVSS first” when the scenario gives exposure, exploitation or asset value that points elsewhere.
Example questions
Question 1. A scan of a laptop fleet shows many missing patches, but several laptops are rarely connected to the corporate network. Which scanning approach gives the most reliable patch data for them?
- A. A scheduled non-credentialed network scan
- B. An external scan from the internet
- C. Passive traffic monitoring on the core switch
- D. Agent-based credentialed scanning
Show answer
Answer: D
Agent-based scanning reports from the host whenever it has connectivity, so remote laptops are covered. Scheduled network scans miss devices that are offline, a non-credentialed external scan cannot see patch state, and passive monitoring only sees traffic crossing monitored links.
Want more questions like this? Full CS0-004 practice tests →
Question 2. A scanner flags a critical flaw on a server, but the analyst confirms the vulnerable service is disabled and the vendor's fix was applied by a different package. How should the finding be treated?
- A. Accept the risk and record the owner
- B. Mark it as a false positive with the supporting evidence
- C. Add a compensating control
- D. Lower the CVSS score manually
Show answer
Answer: B
Confirmed evidence that the flaw is not present makes it a false positive, which is documented and suppressed. Accepting the risk applies to flaws that exist, compensating controls address flaws that remain, and editing the CVSS score does not change whether the flaw is present.
Want more questions like this? Full CS0-004 practice tests →
Question 3. Two vulnerabilities have the same base score. One affects an internet-facing server with known active exploitation. The other affects an isolated lab system. Which should be remediated first?
- A. The internet-facing server
- B. The isolated lab system
- C. Whichever appears first in the report
- D. Both wait for the next scheduled maintenance window
Show answer
Answer: A
Exposure and active exploitation raise real risk even when base scores match. The lab system is lower risk because it is isolated, alphabetical order is not a risk criterion, and waiting for the next maintenance cycle ignores the exploitation evidence.
Want more questions like this? Full CS0-004 practice tests →