CS0-004 domain - 26% of the exam

Vulnerability Management

Vulnerability Management is 26% of the CompTIA CySA+ (CS0-004) exam. These are the objectives it covers, each with practice questions, with every answer explained.

Objectives in this domain

Sample question from this domain

Free sampleVulnerability Managementhard

Within the CVSS version 3.1 framework, what does the Environmental metric group allow an analyst to do that the Base metric group alone cannot?

  • AAdjust the score to reflect the security requirements and modified characteristics of the analyst's own deployment. Correct
  • BReflect the current maturity of available exploit code and the state of official remediation.
  • CExpress the intrinsic severity of the flaw independent of any particular organisation or time.
  • DPredict the probability that the vulnerability will be exploited in the wild within thirty days.
Distinguish the CVSS Environmental metric group as the mechanism for tailoring a base score to local asset context and security requirements. The Environmental group applies modified base metrics and confidentiality, integrity and availability requirement weightings so the final score represents risk to the specific environment rather than the flaw in the abstract.

Why A is correct: Correct: the Environmental group re-weights confidentiality, integrity and availability requirements and lets the analyst override base metrics to match how the asset is actually deployed.

Why B is wrong: Tempting because these do adjust a score over time, but exploit maturity and remediation level belong to the Temporal metric group, not the Environmental group.

Why C is wrong: This describes the purpose of the Base metric group itself, which is the fixed starting point the Environmental group is meant to tailor.

Why D is wrong: Exploitation probability is what EPSS estimates; CVSS environmental scoring measures contextual impact, not likelihood of attack over a time window.

Other domains in this exam

See also the CS0-004 cert hub, the study guide, and the cheat sheet.

Examworthy is not affiliated with or endorsed by CompTIA. Original, blueprint-aligned practice material only.