CompTIA CySA+ (CS0-004) — All Questions

An analyst must prioritize remediation for a vulnerability with a CVSS base score of 9.8. Before escalating, which additional factor most improves prioritization accuracy?

• a.The alphabetical order of the affected hostname
• b.Environmental and threat context such as asset exposure and active exploitation✓
• c.The vendor's marketing severity label only
• d.The number of characters in the CVE identifier

A CVSS base score reflects intrinsic severity but ignores your environment; adding environmental metrics and threat intelligence (like known active exploitation) sharpens real-world risk. A 9.8 on an isolated, non-critical asset may rank below a 7.0 on an internet-facing crown-jewel system. Context-driven prioritization prevents wasting effort on theoretically severe but practically low-risk findings.

A scan of a Linux server reports a critical vulnerability, but manual verification shows the affected package is not installed. How should the analyst classify this result?

• a.False positive✓
• b.True positive
• c.False negative
• d.Zero-day

A false positive occurs when a scanner reports a vulnerability that does not actually exist on the target. Verifying findings before remediation prevents wasted effort and preserves credibility with system owners. Documenting the false positive and tuning the scan policy helps reduce recurrence in future assessments.

An organization wants deeper, more accurate vulnerability results including missing patches and insecure configurations on its servers. Which scan approach best achieves this?

• a.An uncredentialed external scan only
• b.A passive network sniff
• c.A credentialed (authenticated) scan✓
• d.A single ping sweep

Credentialed scans log into the target with valid credentials, allowing the scanner to inspect installed packages, patch levels, and configuration files directly. This yields far more accurate results and fewer false positives than uncredentialed scans, which only see the external surface. The tradeoff is credential management and slightly higher load on scanned systems.

A security team maintains an ongoing inventory of all internet-facing assets, including shadow IT and forgotten cloud instances, to reduce exposure. What discipline does this describe?

• a.Chain of custody
• b.Static malware analysis
• c.Sandboxing
• d.Attack surface management✓

Attack surface management continuously discovers, inventories, and monitors all externally reachable assets to minimize exploitable exposure. It is especially important for catching unmanaged or shadow IT resources that traditional scanning may miss. Reducing the attack surface lowers the number of entry points an adversary can target.

A critical patch cannot be deployed immediately because it requires a maintenance window two weeks out. Which interim measure best reduces risk in the meantime?

• a.Ignore the finding until the patch window
• b.Apply a compensating control such as network segmentation or a WAF rule✓
• c.Increase the CVSS score manually
• d.Delete the vulnerability record from the tracker

When a patch cannot be applied right away, compensating controls like segmentation, virtual patching, or firewall rules reduce exploitability until remediation occurs. This risk-based approach maintains protection without waiting for the maintenance window. Documenting the interim control and the plan to patch keeps the exception auditable.

An analyst is asked to explain why one vulnerability was patched before another with an identical CVSS base score. Which factor most justifies the difference?

• a.One had a public, weaponized exploit and was on an internet-facing asset✓
• b.One CVE was published on an earlier date
• c.One vendor's name comes first alphabetically
• d.One had a longer description in the advisory

Identical base scores can carry very different real-world risk once exploit availability and asset exposure are considered. A weaponized exploit on an internet-facing system dramatically raises the likelihood and impact of compromise. Threat context and exploitability, often reflected in CVSS temporal metrics or exploit prediction scoring, drive rational prioritization.

After remediating a vulnerability, what step best confirms the fix was effective and did not introduce regressions?

• a.Close the ticket immediately based on the vendor's release notes
• b.Wait for the next quarterly scan only
• c.Perform a validation rescan of the affected asset✓
• d.Remove the asset from the scan scope

A validation (verification) rescan confirms the vulnerability is actually resolved and detects any new issues the change may have introduced. Relying on release notes alone or waiting for the next scheduled scan leaves a gap in assurance. Verified remediation closes the loop in the vulnerability management lifecycle and supports accurate metrics.