4.3 - Vulnerability management
Security+ SY0-701 objective 4.3 covers identifying and managing vulnerabilities over time. Vulnerability scanning finds and prioritises known weaknesses by scanning systems against a database of signatures, and should be run on a recurring schedule to catch new issues across the fleet. When a newly discovered critical vulnerability affects internet-facing servers, the first step is usually to test the patch in a staging environment before deploying it, so the fix does not break production. You should also understand analysing scan results, false positives, CVSS scoring, threat feeds, penetration testing and responsible disclosure, plus remediation, validation and reporting. Expect scenario questions that describe finding or prioritising weaknesses, or the safe order of applying a fix, and ask which vulnerability-management activity or first action is correct in the situation.
Find + prioritise known weaknesses = vulnerability scanning (run recurring). Critical patch for internet-facing servers = test in staging FIRST. Then remediate, validate, report. Score severity = CVSS.
Practice questions
1. Which activity finds and prioritizes known weaknesses by scanning systems against a vulnerability database?
- Penetration exploitation
- Vulnerability scanning (correct answer)
- Data classification
- Load balancing
Vulnerability scanning identifies known flaws/misconfigurations (often unauthenticated or credentialed) and helps prioritize remediation. Pentests go further and exploit them.
2. A newly discovered critical vulnerability affects internet-facing servers. The FIRST patch-process step should be to:
- Deploy the patch to all servers
- Test the patch in a staging environment (correct answer)
- Skip testing to save time
- Wait a full quarter to patch
Patch management tests fixes in staging first to avoid breakage, then deploys in a controlled, prioritized way (with a rollback plan) — critical exposed systems get expedited handling.
3. A firm wants consistent, error-free provisioning of hundreds of cloud resources with security baked in. The BEST approach is:
- Manual console clicking each time
- Infrastructure as code with policy checks (correct answer)
- One-off ad-hoc shell scripts
- Emailing config instructions to admins
Infrastructure as code with automated policy/guardrail checks provisions resources consistently and securely at scale, reducing manual misconfiguration. Version-control the templates.
4. To catch and prioritize known weaknesses across the fleet regularly, an org should schedule:
- A yearly staff picnic
- Recurring vulnerability scans (correct answer)
- A one-time firewall rule
- A marketing campaign
Recurring authenticated vulnerability scans (plus continuous monitoring) find and rank known flaws over time, feeding prioritized remediation. Pair with patch management and validation.
5. An org deploys patches to a small pilot group first, then broader waves only if no issues appear. This approach is:
- Immediate fleet-wide push
- Phased deployment (patch rings) (correct answer)
- Skipping all testing
- Manual per-machine copying
Phased deployment/patch rings roll patches to progressively larger groups, catching problems in the pilot before broad rollout — balancing speed and stability. Keep a rollback plan.
6. An org builds one hardened, patched, standardized base image and deploys all new servers from it. This image is called a:
- A snapshot backup
- A golden image (correct answer)
- A crash dump
- A swap file
A golden image is a pre-hardened, patched, standardized template used to provision consistent, secure systems, reducing configuration drift. Keep it updated and re-baseline periodically.