L7. Vulnerability Management: Scanning, CVSS & Patching
Course outlineLesson 7 of 20
Vulnerability management is a continuous cycle of finding, prioritizing, and remediating weaknesses before attackers exploit them. The Security+ exam tests CVSS scoring, the scanning lifecycle, and the difference between scanning and pen testing.
Vulnerability Scanning vs Penetration Testing
| Aspect | Vulnerability Scanning | Penetration Testing |
|---|---|---|
| Method | Automated, non-intrusive | Manual + automated, exploits vulnerabilities |
| Authorization | Routine, ongoing | Explicit written authorization required |
| Output | List of vulnerabilities with severity scores | Proof of exploitation, attack paths, business impact |
| Frequency | Continuous or weekly | Annually or after major changes |
CVSS (Common Vulnerability Scoring System)
CVSS provides a 0-10 numerical score for vulnerabilities based on the following base metrics: Score ranges:
- 0.0: None
- 0.1-3.9: Low
- 4.0-6.9: Medium
- 7.0-8.9: High
- 9.0-10.0: Critical
CVE and NVD
CVE (Common Vulnerabilities and Exposures): provides a unique identifier (CVE-2024-12345) for each publicly known vulnerability. NVD (National Vulnerability Database): enriches CVEs with CVSS scores, affected software lists, and remediation references. Zero-day: a vulnerability with no available patch, often because the vendor is unaware of it. Zero-days have no CVE until they are discovered and disclosed.Patch Management Lifecycle
- Inventory: know all assets and software versions
- Scan: identify vulnerabilities on the current inventory
- Prioritize: combine CVSS score with asset business criticality
- Test: deploy patch in a non-production environment first
- Deploy: roll out via SCCM, Intune, Ansible, or similar
- Verify: re-scan to confirm the vulnerability is remediated
- ✓Vulnerability scanning is automated and non-intrusive; penetration testing actively exploits vulnerabilities and requires written authorization
- ✓CVSS base score ranges: 0-3.9 Low, 4.0-6.9 Medium, 7.0-8.9 High, 9.0-10.0 Critical
- ✓A zero-day vulnerability has no available patch; the vendor typically has had zero days to respond
- ✓CVE provides the unique identifier; NVD enriches CVEs with CVSS scores and remediation guidance
- ✓Patch prioritization must consider both CVSS score AND business criticality of the affected asset
1. Which activity requires explicit written authorization and actively exploits vulnerabilities to demonstrate impact?
2. A CVSS base score of 9.1 indicates which severity level?
3. A researcher discovers a previously unknown vulnerability in a web server with no patch available from the vendor. What is this type of vulnerability called?
Recommended: Pluralsight
Turn your CompTIA Security+ concepts into passing marks: Pluralsight adds structured study plans, practice exams, and hands-on scenario labs.