Overview
Domain 2 covers the vulnerability management cycle from the analyst's seat. It starts with implementing scanning: asset inventory, planning considerations such as scheduling, performance, sensitivity, segmentation and regulation, and scan types including internal and external, agent and agentless, credentialed and non-credentialed, passive and active, discovery scans, and baseline scans against PCI DSS, CIS benchmarks and ISO 27000. It covers analyzing output from network mappers, multipurpose tools such as Nmap and Metasploit, web scanners such as Burp Suite and ZAP, vulnerability scanners such as Nessus and OpenVAS, cloud assessment tools such as ScoutSuite and Prowler, and breach attack simulation tools. It then covers prioritizing and mitigating vulnerabilities using exploitability, threat intelligence, asset value, CVSS and EPSS, and finishes with control types, risk concepts, application security and third-party risk.
The domain connects to Domain 1, where exploitation shows up as indicators, and to Domain 4, where findings become reports and action plans.
How it's tested
Questions present a network, a scan plan or scan output and ask which scan type is appropriate, what the output shows, or which vulnerability to address first. Expect performance-based items where you rank findings or interpret tool results. Read every detail given about each asset.
-
Pick the scan
A requirement such as seeing installed patches, avoiding disruption or testing a web app is given, and you must choose the scan type or tool.
-
Prioritize the findings
Several findings with scores, exposure, asset value and threat intelligence are shown, and you must decide what to remediate first.
-
Remediation constraints
A fix is not possible, and you must choose a compensating control, an exception or another mitigation strategy.
A scan shows a CVSS 9.8 flaw on an isolated lab server and a CVSS 7.5 flaw on an internet-facing VPN appliance that appears in active exploitation reports with a high EPSS score. The higher CVSS number is tempting. But exploitability, exposure and asset value change the risk. The VPN appliance is reachable by attackers and is being exploited now, so it should be fixed first.
Objectives 4
Official objectives from the CompTIA outline, in outline order.
2.1 Given a scenario, implement the appropriate vulnerability scanning method.Asset inventory, planning considerations and scan types.
- What it means
- Scanning begins with an accurate asset inventory. Planning considers scheduling, operational impact, performance, data sensitivity, segmentation and regulatory requirements. Scan types include internal versus external, agent-based versus agentless, credentialed versus non-credentialed, passive versus active, discovery scans for mapping and device fingerprinting, and security baseline scans against PCI DSS, CIS benchmarks or ISO 27000 controls.
- What to understand
- Credentialed scans see installed software, patches and configuration, so they are far more accurate for internal systems. Agents suit mobile or intermittently connected devices. Passive scanning observes traffic without probing, which suits fragile systems such as OT. External scans show what attackers on the internet can see.
- How it shows up
- A requirement is described, such as checking patch levels, avoiding disruption or meeting PCI DSS, and you must choose the scan type or schedule.
- Common confusion
- Assuming non-credentialed scans are safer and just as good. They are less intrusive but miss most host-level vulnerabilities.
2.2 Given a scenario, analyze output from vulnerability assessment tools.Network mappers, multipurpose tools, web, vulnerability and cloud scanners, and breach attack simulation.
- What it means
- Tools listed include Angry IP Scanner and Masscan for network scanning, Nmap, Metasploit Framework, Maltego and Recon-ng as multipurpose tools, Burp Suite, ZAP and Nikto for web applications, Nessus, Nuclei and OpenVAS as vulnerability scanners, ScoutSuite, Prowler, Trivy and Checkov for cloud and infrastructure assessment, and Atomic Red Team and Caldera for breach attack simulation.
- What to understand
- Match the tool to the target. Nmap discovers hosts and services, Burp and ZAP test web applications, Nessus and OpenVAS find known vulnerabilities, Prowler and ScoutSuite check cloud configurations, Trivy scans containers and Checkov scans infrastructure-as-code. Breach attack simulation tests whether defenses detect known techniques. Every result needs validation before action.
- How it shows up
- Tool output is shown and you must interpret it, or a target is described and you must choose the tool.
- Common confusion
- Using a network vulnerability scanner to assess web application logic flaws. Web application scanners and proxies are built for that.
2.3 Given a scenario, analyze data to prioritize and mitigate vulnerabilities.Prioritization criteria, scoring methods, context awareness, mitigation strategies and validation.
- What it means
- Prioritization weighs exploitability, active exploitation and threat intelligence, asset value, impact, patch availability, and true or false positives and negatives. Scoring methods include CVSS metrics and the Exploit Prediction Scoring System (EPSS). Context awareness considers whether an asset is internal, external or isolated. Mitigation strategies include attack surface management, secure coding, patching and configuration management, exceptions and compensating controls, followed by validation of remediation.
- What to understand
- CVSS describes severity, and EPSS estimates the probability a vulnerability will be exploited in the near term. Combining severity, likelihood, exposure and asset value gives a realistic priority. When a patch is not possible, compensating controls and documented exceptions manage the risk. Remediation must be verified by rescanning.
- How it shows up
- A set of findings is presented with context, and you must rank them or choose a mitigation when patching is not possible.
- Common confusion
- Ranking only by CVSS base score without considering exposure, exploitation and asset value.
2.4 Explain concepts related to control types, risks, and vulnerability management.Control types and functions, risk concepts and strategies, governance, application security and third-party risk.
- What it means
- This objective covers control types (administrative, technical, physical), control functions (preventative, detective, responsive, corrective), risk concepts (risk appetite, inherent and residual risk), risk strategies (accept, transfer, avoid, mitigate), policies, governance and service-level objectives (SLOs), application security through SAST, DAST and OWASP SAMM, and third-party risk including supply chain, software composition analysis (SCA) and software bills of materials (SBOM).
- What to understand
- Residual risk is what remains after controls, and it is compared with risk appetite. SLOs set targets such as remediation timeframes by severity. SAST examines code without running it, and DAST tests the running application. An SBOM lists software components, and SCA uses that kind of inventory to find vulnerable dependencies.
- How it shows up
- Questions ask which control function fits a description, which risk strategy applies, or how to find vulnerable third-party components.
- Common confusion
- Using SAST to find vulnerable open-source libraries. SCA and an SBOM address third-party components.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
Credentialed vs. non-credentialed scan
Credentialed scans log in and inspect the system. Non-credentialed scans see only exposed services.
- Remember
- Credentialed scans are more accurate and find more host-level issues.
- Tested as
- Scan selection questions.
- Trap
- Choosing non-credentialed scans to assess internal patch levels.
-
Agent vs. agentless
Agents run on each host and report back. Agentless scans connect over the network.
- Remember
- Agents suit laptops and intermittently connected or cloud workloads.
- Tested as
- Scan design questions.
- Trap
- Relying on agentless scans for devices that are rarely on the network.
-
Passive vs. active scanning
Passive scanning observes traffic. Active scanning sends probes.
- Remember
- Passive suits fragile OT and ICS systems.
- Tested as
- Operational impact questions.
- Trap
- Running aggressive active scans against industrial controllers.
-
CVSS
The Common Vulnerability Scoring System rates technical severity from 0 to 10.
- Remember
- It is a severity measure, not a full risk rating.
- Tested as
- Prioritization questions.
- Trap
- Fixing the highest score first regardless of context.
-
EPSS
The Exploit Prediction Scoring System, maintained by FIRST, estimates the probability that a vulnerability will be exploited in the next 30 days.
- Remember
- It complements CVSS by adding likelihood.
- Tested as
- Prioritization questions.
- Trap
- Treating EPSS as a severity score.
-
Context awareness
Whether an asset is internal, external or isolated changes its exposure.
- Remember
- Internet-facing assets usually deserve higher priority.
- Tested as
- Ranking findings.
- Trap
- Ignoring exposure when ranking.
-
False positive vs. false negative
A false positive reports a vulnerability that is not there. A false negative misses one that is.
- Remember
- Validate findings, and use credentialed scans to reduce false negatives.
- Tested as
- Output analysis questions.
- Trap
- Remediating unvalidated findings.
-
Compensating control
An alternative control used when the primary fix cannot be applied.
- Remember
- It must address the same risk, and is often paired with a documented exception.
- Tested as
- Mitigation questions.
- Trap
- Accepting a control that addresses a different risk.
-
Control functions
CompTIA lists preventative, detective, responsive and corrective.
- Remember
- Responsive controls act during an event, and corrective controls restore afterwards.
- Tested as
- Classification questions.
- Trap
- Mixing up responsive and corrective.
-
Inherent vs. residual risk
Inherent risk is before controls. Residual risk is what remains after them.
- Remember
- Residual risk is compared with risk appetite.
- Tested as
- Risk concept questions.
- Trap
- Comparing inherent risk with appetite.
-
SAST vs. DAST
SAST analyzes code without running it. DAST tests a running application from outside.
- Remember
- SAST finds issues early, and DAST finds runtime and configuration issues.
- Tested as
- Application security questions.
- Trap
- Running DAST before the application can run.
-
SBOM and SCA
An SBOM lists software components. SCA identifies third-party components and their known vulnerabilities.
- Remember
- Together they answer 'are we affected?' when a library flaw is disclosed.
- Tested as
- Third-party risk questions.
- Trap
- Using SAST to find vulnerable dependencies.
-
Cloud assessment tools
ScoutSuite and Prowler audit cloud configurations, Trivy scans containers and images, and Checkov scans infrastructure-as-code.
- Remember
- Match the tool to the cloud layer being assessed.
- Tested as
- Tool selection questions.
- Trap
- Using a network scanner to find cloud misconfigurations.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
CVSS vs. EPSS vs. threat intelligence
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| CVSS | Technical severity of a vulnerability | How bad it would be if exploited | Using it alone to rank findings |
| EPSS | Estimated probability of exploitation in the near term | How likely exploitation is | Treating it as severity |
| Active exploitation intelligence | Evidence the vulnerability is being exploited now | Strongest signal for urgent action | Ignoring it because the CVSS score is moderate |
Credentialed vs. non-credentialed vs. agent-based scanning
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Credentialed | Scanner logs in to the target | Sees patches, software and configuration | Poorly protecting scan credentials |
| Non-credentialed | Scanner probes from outside without logging in | Shows what an unauthenticated attacker sees | Treating it as a complete picture |
| Agent-based | Software on the host reports findings | Works for devices off the network | Forgetting agent deployment and maintenance |
Nmap vs. Nessus vs. Burp Suite vs. Prowler
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Nmap | Host discovery, port scanning and service detection | Maps what is there | Treating open ports as confirmed vulnerabilities |
| Nessus or OpenVAS | Vulnerability scanning against known issues | Finds known vulnerabilities and misconfigurations | Skipping validation of findings |
| Burp Suite or ZAP | Web application testing through an intercepting proxy | Tests web application behavior | Using it for network-wide scanning |
| Prowler or ScoutSuite | Cloud configuration auditing | Checks cloud accounts against best practice | Expecting it to scan application code |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Highest score wins
- What candidates pick
- Remediate the CVSS 9.8 finding on an isolated lab server first.
- Why it looks right
- It has the highest severity.
- Why it's wrong
- An exposed, actively exploited system with a lower score poses more immediate risk.
Clue to watch for The question gives exposure, asset value, EPSS or exploitation data.
-
Non-credentialed for patches
- What candidates pick
- Run a non-credentialed scan to confirm servers have the latest patches.
- Why it looks right
- It is less intrusive and needs no credentials.
- Why it's wrong
- Without logging in, the scanner cannot see installed patches accurately. A credentialed scan is needed.
Clue to watch for The goal involves installed software, patch levels or configuration.
-
Active scan on OT
- What candidates pick
- Run a full active vulnerability scan against SCADA controllers during production.
- Why it looks right
- Full scans are thorough.
- Why it's wrong
- Active probing can crash fragile industrial devices. Passive monitoring or carefully scheduled, vendor-approved testing is safer.
Clue to watch for The environment includes OT, ICS or SCADA.
-
Patch or nothing
- What candidates pick
- Leave a vulnerability unaddressed because the vendor has no patch.
- Why it looks right
- Nothing can be done until a fix exists.
- Why it's wrong
- Compensating controls, segmentation, configuration changes and documented exceptions reduce risk while waiting.
Clue to watch for The question mentions no patch, legacy systems or business constraints.
-
SAST for libraries
- What candidates pick
- Run SAST to find which applications use a newly vulnerable library.
- Why it looks right
- SAST scans code.
- Why it's wrong
- Third-party component identification is the job of SCA and an SBOM.
Clue to watch for The scenario is about dependencies, open-source packages or supply chain.
-
Fixed means verified
- What candidates pick
- Close the finding once the system owner reports it patched.
- Why it looks right
- The owner confirmed the work.
- Why it's wrong
- Remediation must be validated, usually by rescanning.
Clue to watch for The only evidence is the owner's statement.
Answer framework
For any Domain 2 scenario, use these steps to reach the answer CySA+ expects.
- Confirm the asset inventory and planning constraints, such as sensitivity, segmentation, schedule, regulation and fragile systems like OT.
- Choose the scan type and tool that can actually see the problem, preferring credentialed or agent-based scans for host-level accuracy.
- Validate the findings, separating true positives from false positives and considering what the scan might have missed.
- Prioritize using severity together with exploitation likelihood, active exploitation, exposure and asset value, not CVSS alone.
- Mitigate with patches or configuration changes where possible, otherwise with compensating controls and documented exceptions, then verify by rescanning, and record any exception with an owner and a review date.
Practice question
Want more like this? The CySA+ practice test has questions for every domain.
Checklist
0 of 13
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Start with prioritization in 2.3, because it drives the most scenario and performance-based questions. Practice ranking sets of findings using CVSS, EPSS, exploitation status, exposure and asset value, and explain each ranking to yourself.
Next, study scanning methods in 2.1. Build a table of scan types with what each sees and when to use it, paying particular attention to credentialed scanning and to passive approaches for OT.
Then learn the tools in 2.2 by what they assess: network, web, host vulnerabilities, cloud configuration, containers or infrastructure-as-code. Hands-on time with Nmap, a vulnerability scanner and Burp or ZAP helps you read output on the exam. Candidates commonly underestimate 2.4, especially CompTIA's 'responsive' control function, SLOs, and the difference between SCA and SAST.
Afterwards, move to Domain 4. Vulnerability findings become reports, action plans and metrics there, and the inhibitors to remediation listed in Domain 4 explain many of the constraints you meet here.
FAQ
How much of CySA+ CS0-004 is Domain 2?
Vulnerability Management is 26% of the CS0-004 exam.
What is the difference between CVSS and EPSS?
CVSS rates how severe a vulnerability is technically. EPSS estimates how likely it is to be exploited in the near term. Using both, plus context, gives better priorities.
Why are credentialed scans preferred?
They log in to the target and can see installed software, patches and configuration, so they find far more host-level vulnerabilities and produce fewer false positives.
Which tools should I know?
The objectives name tools including Nmap, Masscan, Metasploit, Burp Suite, ZAP, Nikto, Nessus, Nuclei, OpenVAS, ScoutSuite, Prowler, Trivy, Checkov, Atomic Red Team and Caldera. Know what each assesses and how to read typical output.
What if a vulnerability cannot be patched?
Use compensating controls such as segmentation, access restriction and monitoring, document an exception, and plan a longer-term fix.
What changed in Domain 2 from CS0-003?
The weight dropped from 30% to 26%. The CS0-004 objectives also name newer tools, such as cloud and infrastructure-as-code scanners, and scoring methods such as EPSS.
How does Domain 2 relate to Domain 4?
Domain 4 covers reporting vulnerability findings: scan reports, risk scorecards, action plans, inhibitors to remediation and metrics.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
You have covered scan planning, tool output, risk-based prioritization and mitigation, and control and third-party risk concepts. Test whether you can rank findings the way CySA+ expects.