Study guide 8: Vulnerability management
Domain 4: Security Operations · Not started
Main exam topics
Hardening; asset and vulnerability management; monitoring and alerting; identity and access management; automation; firewalls and endpoint protection; log interpretation; incident detection, containment, eradication and recovery; forensic evidence and chain of custody.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Lesson plan · 75 minutes
By the end of this lesson you will be able to:
- Identify OS, firmware, mobile and application vulnerabilities
- Compare credentialed, non-credentialed scans and penetration tests
- Prioritize using CVSS, exposure and asset value
- Remediate and validate with patching, compensating controls and rescans
Topic 8A–8B — Vulnerabilities
Legacy and end-of-life systems no longer receive patches. Firmware and zero-day flaws have no fix yet. Mobile risks include sideloading, rooting and jailbreaking. Application flaws include race conditions (TOCTOU), memory injection, buffer overflows and malicious updates. Cloud risks come mostly from misconfiguration — public storage, excessive permissions. Cryptographic weaknesses include outdated algorithms and poor key handling.
Topic 8C — Identification
Vulnerability scans compare systems with known CVEs; credentialed scans log in and see more with fewer false positives. Threat feeds (OSINT, commercial, ISACs) add context. Penetration tests actively exploit flaws within agreed rules of engagement; bug bounties reward outside researchers. SAST reviews code; DAST tests running apps.
Topic 8D — Analysis and remediation
Confirm findings, discarding false positives and noting false negatives. Prioritize with CVSS, exploitability, exposure and asset criticality. Remediate by patching, configuration change or segmentation; use compensating controls or documented exceptions when patching isn't possible; insurance transfers residual financial risk. Validate with rescans and report results.
Saved