4.2 Vulnerability Scanning, CVSS Prioritization, and SIEM Telemetry

🎯 Key CompTIA Security+ Exam Takeaways

• Credentialed vulnerability scans authenticate locally into target hosts to inspect internal registry keys, patch levels, and installed packages with high fidelity.
• Non-credentialed scans probe open ports and read external service banners from across the network, yielding lower visibility and higher false positives.
• CVSS v3.1 scores vulnerabilities from 0.0 to 10.0 based on Base, Temporal, and Environmental metrics.
• SIEM systems aggregate disparate logs, normalize them into a uniform schema, and apply automated correlation rules to detect multi-stage intrusions.
• Security Orchestration, Automation, and Response (SOAR) executes automated playbooks across security appliances to contain threats at machine speed.

Continuous vulnerability management identifies and remediates software weaknesses before adversaries can exploit them. Vulnerability scanners operate in two primary modes: credentialed and non-credentialed. Non-credentialed scans simulate an external attacker, sending network probes across subnets and analyzing service banners. In contrast, credentialed scans log directly into the target operating system using administrative credentials, inspecting file versions on disk, Windows registry settings, and installed software packages from the inside, uncovering deep configuration vulnerabilities with near-zero false positives.

Vulnerability prioritization utilizes the Common Vulnerability Scoring System (CVSS v3.1). CVSS evaluates base metrics such as Attack Vector (Network, Adjacent, Local, Physical), Attack Complexity (Low, High), Privileges Required (None, Low, High), User Interaction (None, Required), and Impact on Confidentiality, Integrity, and Availability. A score of 9.0 to 10.0 represents a Critical vulnerability requiring emergency remediation.

In the Security Operations Center (SOC), Security Information and Event Management (SIEM) systems act as the central nervous system. SIEMs ingest billions of daily events from firewalls, Active Directory, cloud audit trails, and EDR agents. The SIEM performs log normalization—parsing heterogeneous vendor log syntaxes into a standardized data model—and applies correlation rules to link seemingly isolated events into coherent incident alerts. SOAR platforms ingest these SIEM alerts and trigger automated playbooks, executing rapid containment actions (e.g., blocking an IP on firewalls, isolating a workstation in EDR) in milliseconds.

⚠️ Common Pearson VUE Exam Traps

• Relying solely on non-credentialed scans; external scans miss missing OS security patches and internal misconfigurations visible only from inside the host.
• Assuming SIEM and SOAR are identical; SIEM aggregates, normalizes, and correlates log data, while SOAR takes active automated remediation actions via playbooks.