Prioritize and mitigate vulnerabilities

• CVSS describes technical severity rather than a complete business risk ranking
• CVSS v4.0 separates intrinsic severity from threat and environmental context
• CVSS Attack Vector describes the access context required for exploitation
• CVSS Privileges Required measures access possessed before exploitation
• CVSS User Interaction concerns participation by someone other than the attacker
• CVSS v4.0 distinguishes defeating protections from requiring execution conditions
• CVSS impact distinguishes disclosure, modification, and loss of service
• CVSS v4.0 Supplemental metrics add context without changing the score
• EPSS estimates exploitation likelihood rather than the damage from exploitation
• An EPSS percentile is a relative rank rather than an exploitation probability
• An EPSS probability is tied to its score date and forecast window
• An EPSS model revision can change scores without a change in the vulnerability
• CVSS Exploit Maturity distinguishes proof-of-concept availability from stronger exploitation evidence
• CVSS Environmental metrics express local criticality and compensating controls
• CVSS distinguishes supplemental Safety context from deployment-specific safety impact
• CVSS Automatable describes reliable attack automation across targets
• CVSS Recovery and Vulnerability Response Effort describe different operational burdens
• CVSS Value Density describes the resources gained through one exploitation event
• CVSS Provider Urgency conveys the provider's additional assessment
• Confirmed exploitation evidence takes precedence over a low predictive score
• Business consequence can make the same vulnerability more urgent on one asset
• Reachability and attack prerequisites determine whether a weakness presents an immediate path
• Isolation reduces exposure without removing the underlying vulnerability
• Several lower-rated weaknesses can combine into a more serious attack path
• A true positive reports a vulnerability that is actually present
• A false positive reports a weakness that the asset does not have
• A false negative is a vulnerability that an assessment fails to report
• A true negative requires absence of both the finding and the actual weakness
• Unpatchable mission-critical systems need layered compensating controls
• Removing unnecessary functionality reduces the attack surface
• Configuration remediation must address the source that reapplies an unsafe setting
• Patch authenticity and integrity must be checked before deployment
• A staged rollout limits the operational risk of routine patching
• Urgent exploitation may require accelerated patching instead of the routine schedule
• Temporary mitigations need a transition to a permanent fix
• Rolling back a security patch can restore the original exposure
• Attack surface management connects ongoing discovery to exposure reduction
• Remediation closure requires evidence that the original condition was corrected
• An installed patch may require activation before it protects the running service
• Compensating controls must be tested against the attack path they are meant to restrict
• A security fix must be checked for operational and security regressions
• Verified remediation must remain effective after later system changes
• Parameterized queries keep untrusted values separate from SQL structure
• Output encoding must match the browser context receiving untrusted data
• Authorization must be enforced for the requested resource and action
• File-access remediation must confine requests to authorized locations

Unlock with Premium — includes all practice exams and the complete study guide.