RANGER CompTIA Security+ (SY0-701) · chapter 16 of 27
Month 7: The scan came back red
In this chapter Objectives 4.3
Objective 4.3
Finding vulnerabilities
Vulnerability scans and application testing
A vulnerability scan checks systems for known flaws, missing patches and bad settings. Credentialed scans log in and see far more than non-credentialed ones. For applications: static analysis reviews source code without running it; dynamic analysis tests the running app (including fuzzing with unexpected input); package monitoring tracks the third-party libraries and packages your code depends on and alerts when one gets a known vulnerability.
Exam tip Memory trick: static = reading the recipe; dynamic = tasting the soup.
Threat feeds
A threat feed delivers current indicators and vulnerability news.
- OSINT (open-source intelligence): free public sources such as advisories, vendor bulletins and security blogs.
- Proprietary/third-party: paid feeds from security vendors, often curated and correlated.
- Information-sharing organization: groups (such as industry ISACs) where members share threats in their sector.
- Dark web: monitoring criminal forums and markets for leaked company data or planned attacks.
Pen tests, disclosure programs and audits
Penetration testing goes beyond scanning: testers actually try to exploit flaws to prove impact. A responsible disclosure program tells outside researchers how to report flaws privately so you can fix them before they go public. A bug bounty program adds rewards for valid reports. A system/process audit reviews how systems and processes are configured and run against requirements, finding weaknesses scans miss (like no review of admin accounts).
Objective 4.3
Analysis, response, validation, reporting
Confirmation: false positives and false negatives
Scanners are not perfect. A false positive reports a vulnerability that is not really there (wastes time). A false negative misses a vulnerability that is there (dangerous, because nobody fixes it). Confirm findings before acting: check the version, the configuration, the vendor advisory.
Exam tip Trap: false negatives are the more dangerous error, because they create false confidence.
CVE and CVSS
A CVE is a unique public ID for a known vulnerability (format CVE-year-number; the program is Common Vulnerabilities and Exposures, listed in the objectives as "Common Vulnerability Enumeration"). CVSS (Common Vulnerability Scoring System) scores severity from 0.0 to 10.0.
CVSS rating score None 0.0 Low 0.1 - 3.9 Medium 4.0 - 6.9 High 7.0 - 8.9 Critical 9.0 - 10.0
Exam tip Memory trick: CVE = the name tag. CVSS = the danger score.
Prioritize with context
The base score is a start. Prioritize using: vulnerability classification (what kind of flaw and how severe), exposure factor (the percentage of the asset's value that would be lost if the flaw is exploited), environmental variables (is it internet-facing? are there compensating controls?), industry/organizational impact (what a breach here would do to this business) and risk tolerance (how much risk the organization will accept and for how long).
Exam tip Exam tip: an internet-facing 8.0 can outrank an isolated 9.8. Environment changes priority.
Response and remediation
Ways to respond:
- Patching: apply the vendor fix. The best answer when a patch exists.
- Insurance: cyber insurance transfers some of the financial impact; it does not remove the flaw.
- Segmentation: isolate the vulnerable system so attackers cannot reach it.
- Compensating controls: other controls that reduce the risk when the fix is impossible (extra monitoring, a WAF rule).
- Exceptions and exemptions: formally approved and documented decisions not to fix (yet), with an owner and review date.
Validation and reporting
Prove the fix worked. Validation of remediation: rescanning to confirm the finding is gone, an audit to check the change was made correctly, and verification (testing directly, for example confirming the patched version is running). Then reporting: share status with owners and leadership: what was found, what was fixed, what is accepted and the trend over time.
Exam tip Exam tip: "how do we confirm the patch fixed it?" = rescan.
Check yourself 1A scan reports a critical Apache web server flaw on a host that runs only Microsoft IIS. No Apache software is installed. What is this?
- False negative
- True positive
- Zero-day
- False positive
Show the answer
Answer: D. False positive
The scanner reported a vulnerability that does not exist on the host, which is a false positive.
Practice questions
Answer in your head, then open the answer. Ranger's Cyber Patrol has 60 questions like these for Security+, with mock exams.
Question 1A scanner reports the CVSS v3.1 vector in the exhibit for a flaw on Kibble & Co.'s file server. Which statement BEST describes what an attacker needs in order to exploit it?
- Physical access to the server's console or USB ports
- A logged-in user on the server who opens a malicious file
- A low-privilege account that can run code on the server itself
- Only network access to the server, without needing any account at all
Show the answer
Answer: C. A low-privilege account that can run code on the server itself
AV:L means local access to the system, PR:L means low privileges are required, and UI:N means no user has to help. The C, I and A values show a full loss of confidentiality, integrity and availability once it is exploited.
Question 2Kibble & Co. can patch only one system this weekend. Its scan results are in the exhibit. Which finding should be fixed FIRST?
- A, the HR test VM
- D, the print server
- C, the intranet wiki
- B, the remote-access VPN
Show the answer
Answer: D. B, the remote-access VPN
Finding B is internet-facing and in CISA's Known Exploited Vulnerabilities catalog, so attackers are actively using it. The 9.1 has a higher base score but sits on an isolated lab VLAN with no known exploit.
Question 3Kibble & Co. is buying a closed-source delivery-tracking web app, and the vendor will not share its source code. Before go-live, security must find flaws such as broken session handling and missing authorization checks on API calls. Which identification method fits BEST?
- Dynamic analysis of the running application
- A credentialed scan of the host OS
- Package monitoring of its third-party dependencies
- Static code analysis of the source
Show the answer
Answer: A. Dynamic analysis of the running application
Dynamic analysis tests the application while it runs, sending requests the way users and attackers do, so it needs no source code and can reveal session and authorization flaws. Static analysis requires the source the vendor will not provide.
Question 4Policy: High findings must be fixed in 30 days; a missed deadline needs an approved exception with a compensating control, or escalation to the CISO. A High finding on the order-API server is 34 days old with no exception, because the patch breaks checkout and the vendor's fix is three weeks away. What is the BEST next step?
- Install the patch anyway and accept the checkout outage
- Add a compensating control and request a formal exception
- Close the finding, since a vendor fix is already scheduled
- Lower the finding to Medium to get 90 days
Show the answer
Answer: B. Add a compensating control and request a formal exception
The finding is past its deadline with no exception, and patching would break checkout, so policy calls for a compensating control and an approved exception until the vendor fix. Closing or downgrading the finding only hides the risk.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.