SY0-701 · Objective 4.3 · Security Operations
4.3 Vulnerability management explained
The official objective: “Explain various activities associated with vulnerability management.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 4.3 covers
Objective 4.3 follows vulnerabilities from discovery to closure. The exam checks that you know each step and the vocabulary attached to it.
Identification methods come first. Vulnerability scans check systems for known weaknesses. A credentialed scan logs in to the target and can read installed software, patch levels and configuration, so it is far more accurate than a non-credentialed scan that only sees what is exposed on the network. Application security testing includes static analysis (reading code), dynamic analysis (testing the running program) and package monitoring (watching third-party libraries for new vulnerabilities). Threat feeds bring outside information, from open-source intelligence, paid feeds, information-sharing organisations and the dark web. Penetration testing actively exploits weaknesses to show real impact. Responsible disclosure programmes and bug bounties invite outside researchers to report what they find.
Analysis decides what the findings mean. Confirmation separates real issues from false positives (reported but not actually present) and false negatives (present but missed). Prioritisation decides what to fix first. CVE gives each publicly known vulnerability a unique identifier. CVSS gives it a severity score from 0 to 10. The base score describes the flaw itself, but the exam expects you to adjust for your environment: exposure factor, environmental variables, industry and organisational impact, and risk tolerance. A 9.8 on an isolated, unreachable server may rank below a 7.5 on an internet-facing one.
Response and remediation is where action happens. Patching is the usual fix. Insurance can transfer some financial risk. Segmentation and other compensating controls reduce exposure when a patch isn't possible yet. Exceptions and exemptions formally accept the risk for a defined period, with an owner, an expiry date and usually added monitoring.
Validation proves the fix worked: rescan, audit the change and verify the result. Reporting closes the loop by showing leadership how many vulnerabilities are open, how quickly they are fixed and whether targets are being met.
Most exam questions in this objective are about choosing the right next step: run a credentialed scan when results look incomplete, confirm before acting on an unexpected finding, rescan after patching, and document an exception when the business genuinely can't remediate yet.
What candidates mix up
- False positive versus false negative: a false positive reports a problem that isn't there; a false negative misses one that is.
- CVE versus CVSS: CVE identifies the vulnerability; CVSS scores its severity.
- Exception versus ignoring a finding: an exception is documented, approved, time-limited and usually comes with compensating controls.
- Credentialed versus non-credentialed: credentialed scans see inside the host and produce more accurate results.
Practice questions for 4.3
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A vulnerability scan is run with valid administrative credentials supplied to the target hosts. Compared with a non-credentialed scan, what is the main benefit?
- AIt can read installed patches and local settings, so findings are more accurate
- BIt avoids generating logon events, so defenders are less likely to notice it
- CIt shows services exactly as an unauthenticated outside attacker sees them
- DIt removes the need to protect and monitor a privileged scanning account
Show answer and explanation
Answer: A) It can read installed patches and local settings, so findings are more accurate
Credentialed (authenticated) scans inspect hosts from the inside, so they see actual patch levels and configurations and produce more accurate results with fewer false positives. The trade-off is that the privileged scan account must be protected.
- ACorrect. Once logged in, the scanner can directly check installed software versions, patch levels, and configuration. It doesn't have to infer them from banners or service responses, so it finds more real issues and reports fewer false positives.
- BCredentialed scans authenticate to each host, which produces logon and local activity events. They're generally more visible, not less.
- CThat's the perspective of a non-credentialed scan, which tests from the outside using techniques such as port scanning, banner grabbing, and service fingerprinting.
- DIt does the opposite. A credentialed scan depends on a privileged account whose credentials must be protected, monitored, and used only for scanning.
Question 2
A vulnerability has a CVSS base score of 9.1, but the affected server is isolated on a segment with no inbound access. How should the team account for this when prioritizing?
- AAdjust using environmental factors
- BIgnore the vulnerability entirely
- CRaise the base score to 10.0
- DTreat it as a false positive
Show answer and explanation
Answer: A) Adjust using environmental factors
- AEnvironmental metrics adjust the base score for the organization's own context, such as reachability and asset value.
- BIsolation lowers the risk but doesn't remove it; it still needs tracking and remediation.
- CThe base score reflects the vulnerability itself; it isn't changed to reflect local context.
- DThe vulnerability exists; exposure, not accuracy, is what differs.
Question 3
A business unit can't patch a vulnerable application until a vendor update next quarter. Security formally documents the decision, sets an expiry date and adds monitoring. What is this?
- AA vulnerability exemption
- BA false positive finding
- CA legal hold
- DDecommissioning
Show answer and explanation
Answer: A) A vulnerability exemption
- AA time-limited, approved exemption documents why remediation is delayed and what reduces the risk meanwhile.
- BThe vulnerability is real, so it isn't a false positive.
- CA legal hold preserves data for litigation.
- DThe application stays in use.
Other Security Operations objectives
Also: the Security Operations domain page (28% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.