CompTIA CySA+ CS0-003 Study Guide: Vulnerability Management

Coverage: CySA+ domain 2.0 Vulnerability Management

This guide is the remediation map for the original local question bank. It follows the supplied CS0-003 objectives and courseware without reproducing exam or commercial practice questions.

Analyst Method

1. Establish what the artifact proves and what remains unknown.
2. Correlate host, network, identity, application, and time context.
3. Choose the action that best reduces risk while preserving evidence and process.
4. Prefer durable controls and measurable validation over point fixes.
5. Communicate confirmed facts, impact, ownership, and next decisions for the audience.

Objective Coverage

• 2.2: 17 questions
• 2.1: 18 questions
• 2.3: 15 questions
• 2.4: 14 questions
• 2.5: 10 questions

Domain Workflow Playbook

Vulnerability Management is a chain from authorized discovery to validated and communicated risk reduction. Record assessment scope and limitations before reading severity. Reconcile every result to a durable asset and owner, verify how the scanner reached its conclusion, interpret CVSS components, add threat and business context, select a control that addresses the mechanism, and retain evidence that the control worked. The courseware treats a finding as open until implementation and validation are complete; package download, ticket assignment, or a compensating control can change status and priority but does not erase the underlying weakness.

2.2 Given a scenario, analyze output from vulnerability assessment tools.

Courseware objective context. Assessment output is a claim supported by evidence, not a verdict. Read discovery state, authentication success, plugin method, request and response context, package source, and scanner confidence. Reconcile results to durable asset identity and current lifecycle state. Validation should be authorized and proportional: confirm configuration or package evidence before exploit-like testing, and preserve the request, command, or output needed to reproduce the conclusion.

Web assessment output

Definition and purpose. Requests, responses, parameters, authentication state, and server behavior are needed to validate Burp, ZAP, debugger, and web-scanner findings safely.

Analyst workflow. Preserve method, URL, parameter, headers, cookies, role, request ID, response body and timing, then reproduce with safe true and false controls in an authorized environment.

Worked artifact or example. Changing /api/invoices/4102 under user A and receiving user B's invoice demonstrates object-level authorization failure; a numeric ID alone does not prove SQL injection.

Commands, filters, or calculations. Use Burp Repeater or ZAP with scoped sessions, browser developer tools, server request IDs, and differential timing controls. Capture exact encoding and output context for XSS.

Common traps. Reflection is not execution, one slow response is not time-based SQL injection, and a WAF match is not application exploit proof. Keep production tests non-destructive.

Question-bank coverage: 6 items.

Network and host assessment output

Definition and purpose. Interpret scanner and Nmap evidence by checking discovery status, service detection, credentials, plugin evidence, versions, and false-positive conditions.

Analyst workflow. Read host discovery, port state, service fingerprint, authentication, package inventory, plugin method, and evidence together; reconcile the result with ownership and lifecycle records.

Worked artifact or example. Nmap open|filtered for UDP means silence could be an open service or filtering. An authenticated fixed vendor package can disprove an older remote banner finding.

Commands, filters, or calculations. Use nmap -sV and approved protocol checks, package queries such as rpm -q or dpkg -l, vendor advisories, scanner plugin output, and durable cloud instance IDs.

Common traps. A banner is not package state, filtered is not closed, and a different application title is not proof of compromise. Avoid deduplicating ephemeral assets by IP.

Question-bank coverage: 8 items.

Cloud and human assessment output

Definition and purpose. Cloud tools reveal identity, storage, logging, and network posture; social-engineering results require authorized scope and meaningful measures beyond click counts.

Analyst workflow. Validate tenant, account, region, scanner permissions, effective policy, inherited controls, object sensitivity, simulation scope, and metric denominator before accepting a result.

Worked artifact or example. A bucket tagged public must be checked for effective anonymous access and actual data sensitivity. In phishing simulation, credential submission measures harmful action more directly than message opens.

Commands, filters, or calculations. Review provider IAM-policy evaluation, storage ACL and public-access blocks, audit logs, Prowler or ScoutSuite evidence, and simulation reports split by delivered, opened, clicked, submitted, and reported.

Common traps. A wildcard policy remains excessive after credential rotation. Open rates include preview and security tooling; simulation results must never justify unapproved targeting or public shaming.

Question-bank coverage: 3 items.

2.1 Given a scenario, implement vulnerability scanning methods and concepts.

Courseware objective context. Scanning begins with authorization, safety, and a question the assessment must answer. Select active, passive, agent, credentialed, application, or configuration techniques according to asset sensitivity and lifecycle stage. Record scope, exclusions, vantage point, credential level, timing, and stop conditions. In operational technology and fragile environments, a less intrusive method with explicit limitations is often more valuable than broad unsafe coverage.

Scanning methods and safety

Definition and purpose. Choose active or passive discovery, scan timing, intensity, and safety controls according to scope, operations, asset sensitivity, and critical-infrastructure constraints.

Analyst workflow. Confirm authorization, asset sensitivity, operational window, scan intensity, safety exclusions, monitoring contacts, stop conditions, and rollback before active testing.

Worked artifact or example. For a fragile clinical or industrial device, passive discovery and vendor-approved checks can establish exposure while an owner-reviewed outage window is arranged.

Commands, filters, or calculations. Use rate and concurrency controls, safe-check profiles, packet or service monitoring during scans, and explicit communication channels for operations to stop the test.

Common traps. A broad target range is not complete authorization. Non-credentialed does not mean non-intrusive, and a successful scan can still disrupt stateful equipment.

Question-bank coverage: 5 items.

Scan scope, vantage, and authentication

Definition and purpose. Internal and external, agent and agentless, credentialed and non-credentialed scans provide different visibility. Scope and credentials must be authorized and tested.

Analyst workflow. Map internal and external vantage points, durable asset identifiers, live-host discovery assumptions, credential privileges, excluded paths, and expected coverage before comparing results.

Worked artifact or example. A ping-filtered host may require an approved -Pn scan. Marking it decommissioned from failed discovery confuses reachability with lifecycle state.

Commands, filters, or calculations. Use Nmap -Pn and service detection within scope, scanner credential diagnostics, cloud account and region inventory, and agent status for intermittently connected endpoints.

Common traps. IP addresses are weak cloud identity. Credentialed scans can overstate coverage when authentication fails, and external scans cannot observe internal patch or configuration state.

Question-bank coverage: 4 items.

Application and baseline scanning

Definition and purpose. Static, dynamic, interactive, baseline, and configuration assessment answer different questions and should be applied at the appropriate lifecycle stage.

Analyst workflow. Choose SAST before execution, DAST against running interfaces, IAST for instrumented runtime paths, SCA for dependencies, and baseline checks for approved configuration drift.

Worked artifact or example. A request-to-sink trace inside an instrumented test runtime is IAST; source inspection before build is SAST; black-box interaction with the deployed interface is DAST.

Commands, filters, or calculations. Preserve build commit, dependency lockfile, runtime version, authentication role, request ID, and baseline profile so findings can be reproduced and assigned.

Common traps. One method cannot see every weakness. A clean SAST result does not validate deployment configuration, and a DAST result may miss unreachable code or unauthenticated paths.

Question-bank coverage: 5 items.

Frameworks and scanner content

Definition and purpose. CIS, OWASP, PCI DSS, SCAP, CVE, CPE, OVAL, and XCCDF provide standards, identifiers, and machine-readable assessment content.

Analyst workflow. Use the framework that matches the decision: CIS for prescriptive hardening, OWASP for web testing and awareness, PCI DSS for cardholder requirements, and SCAP components for machine-readable checks.

Worked artifact or example. In SCAP, OVAL expresses machine-checkable conditions, XCCDF structures benchmark content, CPE identifies platforms, CVE identifies vulnerabilities, and CCE identifies configuration issues.

Commands, filters, or calculations. Inspect scanner references and mappings rather than relying on a title. Compare the selected benchmark profile with organizational tailoring and retain approved deviations.

Common traps. NIST CSF outcomes are not a Windows hardening checklist. CWE catalogs weakness types, and CVSS scores severity; neither replaces a complete authorized testing workflow.

Question-bank coverage: 4 items.

2.3 Given a scenario, analyze data to prioritize vulnerabilities.

Courseware objective context. Prioritization combines intrinsic severity with threat and business context. Interpret CVSS components accurately, then add exposure, known exploitation, exploit maturity, asset purpose, data sensitivity, compensating controls, and operational consequence. Use a documented model consistently, but keep its inputs visible so a score never hides judgment. A lower-CVSS public gateway in KEV can outrank a higher-scored isolated kiosk.

CVSS interpretation

Definition and purpose. CVSS base metrics describe intrinsic severity. Attack vector, complexity, privileges, interaction, scope, and CIA impact must be read accurately before adding business context.

Analyst workflow. Read the vector left to right: attack vector, complexity, privileges, user interaction, scope, then confidentiality, integrity, and availability impact. Translate each value from scenario evidence.

Worked artifact or example. AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H is remote, low-complexity, unauthenticated, no-user-action exploitation with unchanged scope and high CIA impact.

Commands, filters, or calculations. Use the official CVSS calculator after selecting metrics independently. For complete report disclosure with no modification or outage, choose C:H/I:N/A:N.

Common traps. Public exploit code changes threat context, not the Base vector. Scope is a security-authority boundary, and user interaction concerns a separate victim action rather than attacker login.

Question-bank coverage: 6 items.

Validation and result quality

Definition and purpose. Distinguish true and false positives and negatives through safe evidence collection, version and configuration checks, and controlled validation.

Analyst workflow. Confirm asset identity, scan coverage, authentication, deployed version, configuration, evidence method, and safe reproduction; then classify true or false positives and negatives explicitly.

Worked artifact or example. A scanner finding disproved by an SBOM and signed fixed package is a false positive. A known vulnerable excluded port missed by the scan is a false negative.

Commands, filters, or calculations. Compare scanner evidence with package managers, SBOMs, signatures, vendor advisories, service configuration, and controlled test results; preserve why the status changed.

Common traps. An exclusion explains a miss but does not create accepted risk. Closing one backport false positive does not justify suppressing all future findings for that product family.

Question-bank coverage: 2 items.

Contextual prioritization

Definition and purpose. Exploitability, active weaponization, exposure, asset value, data sensitivity, compensating controls, and zero-day status turn severity into a remediation priority.

Analyst workflow. Combine severity with exposure, KEV or exploitation status, exploit maturity, asset impact, data sensitivity, compensating controls, age, and remediation feasibility in a documented queue.

Worked artifact or example. With priority = CVSS x exposure x impact, 7.5 x 1.0 x 5 = 37.5 outranks 9.0 x 0.2 x 2 = 3.6; keep inputs beside the score.

Commands, filters, or calculations. Join scanner findings to asset inventory, threat feeds, KEV, control validation, and business-service records. Recalculate when exposure, exploit code, or compensating controls change.

Common traps. Equal CVSS does not mean equal risk, and a higher isolated score need not outrank a lower exposed KEV finding. Do not modify Base metrics to encode local controls.

Question-bank coverage: 7 items.

2.4 Given a scenario, recommend controls to mitigate attacks and software vulnerabilities.

Courseware objective context. Controls must address the mechanism in the scenario. Server-side authorization differs from authentication; parameter binding differs from input filtering; canonical path containment differs from extension allowlisting; and bounds checking differs from exploit mitigations such as ASLR. Prefer controls that remove the unsafe behavior, then layer least privilege, segmentation, monitoring, and recovery to reduce residual likelihood and impact.

Access and injection controls

Definition and purpose. Server-side authorization, parameterized queries, input validation, output encoding, CSRF defenses, and least privilege address different web attack classes.

Analyst workflow. Identify the trust decision or parser boundary, enforce authorization server-side, keep untrusted data separate from code, and validate the fix with positive and negative tests.

Worked artifact or example. Parameterized SQL binds the username as data; object authorization checks the authenticated principal for every requested ID; anti-CSRF state binds a transfer to the legitimate request flow.

Commands, filters, or calculations. Use prepared statements, centralized policy checks, request-bound CSRF tokens, context-aware output encoding, secure code review, and regression tests for adjacent object IDs and roles.

Common traps. Random IDs, client-side checks, manual quote escaping, and keyword-blocking WAF rules are incomplete. Authentication once does not authorize every object in the session.

Question-bank coverage: 4 items.

Request, file, and execution controls

Definition and purpose. SSRF, directory traversal, LFI/RFI, and remote execution require strict allowlists, canonical path handling, isolation, and reduced service privilege.

Analyst workflow. Resolve and canonicalize inputs, compare with an allowlist or fixed server mapping, block private and link-local egress where applicable, and avoid passing user data to a shell.

Worked artifact or example. For SSRF, validate the destination after DNS resolution and redirects. For traversal, enforce that the canonical path remains under the approved base directory.

Commands, filters, or calculations. Use fixed argument APIs, URL parsers, egress proxy policy, canonical path functions, container or service isolation, and tests for encoding, redirect, DNS-rebinding, and nested traversal cases.

Common traps. HTTPS can still target metadata, extension allowlists do not stop traversal, and stripping one ../ is bypassable. Lower privilege reduces impact but does not remove injection.

Question-bank coverage: 5 items.

Overflow and platform controls

Definition and purpose. Memory-safe design, bounds checking, ASLR, DEP, compiler protections, patching, and architecture choices reduce overflow exploitation.

Analyst workflow. Trace untrusted size and index values through arithmetic, allocation, copy, and control data; add precondition and bounds checks before the unsafe operation.

Worked artifact or example. Two 32-bit lengths can wrap to a small sum and under-allocate memory. Check overflow before addition and allocation rather than detecting corruption after the copy.

Commands, filters, or calculations. Use compiler warnings, sanitizers, fuzzing, checked arithmetic, memory-safe libraries, ASLR, DEP, stack canaries, and regression tests at boundary values.

Common traps. A larger buffer or 64-bit type only moves the boundary. Exploit mitigations raise difficulty but do not correct an unbounded copy or arithmetic error.

Question-bank coverage: 2 items.

Design, component, and data controls

Definition and purpose. Threat modeling, secure defaults, supported components, strong cryptography, and protected training data address insecure design, misconfiguration, EOL, cryptographic failure, and poisoning.

Analyst workflow. Threat-model trust boundaries and unsafe defaults, inventory supported components, protect secrets and training data, and validate secure configuration at build and deployment gates.

Worked artifact or example. Unsalted MD5 requires migration to a salted adaptive password hash. Manipulable customer labels require training-data provenance, integrity checks, and distribution monitoring.

Commands, filters, or calculations. Use SBOM and dependency policy, secret scanning, signed artifacts, hardened templates, adaptive password hashing, dataset lineage, model drift monitoring, and supported-release inventory.

Common traps. Encryption at rest does not fix weak password verifiers, more poisoned data does not dilute a coordinated attack, and banner hiding does not patch end-of-life code.

Question-bank coverage: 3 items.

2.5 Explain concepts related to vulnerability response, handling, and management.

Courseware objective context. Vulnerability handling is an owned lifecycle: choose treatment, plan the change, test it, retain rollback, validate the result, and close or time-bound any exception. Policy deadlines, vendor dependencies, maintenance windows, and service risk belong in the action record. Secure development and attack-surface work move this reasoning earlier by reducing unsafe defaults and unsupported components before they become production findings.

Risk treatment and control selection

Definition and purpose. Accept, transfer, avoid, or mitigate risk through accountable decisions. Select managerial, operational, or technical controls with preventive, detective, responsive, or corrective functions.

Analyst workflow. Name the accountable risk owner, choose accept, transfer, avoid, or mitigate, document residual risk and review date, and classify selected controls by function and implementation type.

Worked artifact or example. Cyber insurance transfers part of financial impact while operations remain internal. Retiring the risk-producing service avoids risk; patching or segmenting it mitigates risk.

Commands, filters, or calculations. Maintain a risk register with likelihood, impact, treatment, controls, owner, approval, expiration, evidence, and validation; link exceptions to the affected findings and assets.

Common traps. Transfer does not remove all accountability, and acceptance requires an authorized decision. Detective alerts do not become corrective until a workflow restores approved state.

Question-bank coverage: 3 items.

Patch, configuration, and exceptions

Definition and purpose. Test, implement, validate, and retain rollback options. Time-bound exceptions need owners, compensating controls, review dates, and maintenance-window planning.

Analyst workflow. Test the change, schedule the window, establish backup and rollback criteria, apply interim controls, implement, verify service and security state, and close through independent validation.

Worked artifact or example. A 24x7 service plan should include a window, segmentation or monitoring until then, rollback, and post-change checks. An OT exception needs owner, shutdown date, residual risk, and expiry.

Commands, filters, or calculations. Track policy SLO, owner, package, prerequisites, change ticket, maintenance window, rollback trigger, exception approval, review date, and rescanning or configuration evidence.

Common traps. Installed packages may still need reboot or service restart. A permanent exception or unsupported hot patch hides risk instead of managing the dependency.

Question-bank coverage: 4 items.

Secure development and attack surface

Definition and purpose. Embed secure coding, SDLC gates, threat modeling, edge and passive discovery, control testing, penetration testing, adversary emulation, and bug bounty input into continuous reduction of exposure.

Analyst workflow. Discover assets continuously, validate ownership, threat-model changes, apply secure SDLC gates, test controls, and feed authorized penetration or bounty findings into owned remediation.

Worked artifact or example. A certificate-transparency subdomain absent from inventory becomes a validation and ownership task, not automatic permission for authenticated testing or immediate DNS removal.

Commands, filters, or calculations. Use passive DNS, certificate transparency, cloud inventory, SAST, SCA, IaC scanning, DAST in test, threat-model records, and scoped penetration or adversary-emulation reports.

Common traps. Discovery is not authorization. Bug bounties require explicit scope and safe-harbor terms, and one quarterly inventory cannot represent rapidly changing cloud exposure.

Question-bank coverage: 3 items.