CompTIA Security+ Education & Occupational Skills Learning Path • Module 5

Risk and Vulnerability Management

Apply identifying weaknesses, evaluating risk, and selecting treatment through approved procedures, objective verification, documentation, and escalation.

22 minutes80% mastery targetPractice—unlimited attempts

Enter your participant information to start activity tracking.

Learning outcomes

Explain the purpose of identifying weaknesses, evaluating risk, and selecting treatment.
Apply approved procedures to a realistic CompTIA Security+ situation.
Verify results, document objective evidence, and escalate conditions outside authorized scope.

Apply the approved workflow

Distinguish a weakness from the threat that could exploit it. Evaluate likelihood, impact, existing controls, and business context. Reliable performance begins with correct identification, current instructions, safe conditions, and a clear understanding of authority.

Key points

Distinguish a weakness from the threat that could exploit it.
Evaluate likelihood, impact, existing controls, and business context.
Confirm scope and prerequisites before acting.

Verify, document, and communicate

Track treatment decisions, owners, due dates, and accepted residual risk. A task is not complete until the result is checked against the expected outcome and the record allows another authorized person to understand what occurred.

Key points

Track treatment decisions, owners, due dates, and accepted residual risk.
Record objective facts, actions, results, and unresolved risks.
Escalate exceptions promptly through the authorized channel.

Applied scenario

Risk and Vulnerability Management: verify before proceeding

During a security operations task involving a protected organizational asset, a CompTIA Security+ practitioner is completing the Risk and Vulnerability Management module scenario. An identifier, instruction, measurement, or expected result does not agree with the available record. The task has a deadline, but proceeding without resolving the conflict could create safety, privacy, quality, compliance, or service risk. Decide how the task should continue and what evidence must be recorded.

Practice check

Apply what you learned

Answer all five questions. Feedback will identify what to review before you try again.

1Which action best supports identifying weaknesses, evaluating risk, and selecting treatment? Keep privileged access after the role or business need has ended Distinguish a weakness from the threat that could exploit it. Change incident timestamps to make the response sequence appear complete Collect and retain sensitive data that is not needed for an authorized purpose

2Within Risk and Vulnerability Management, what should happen before the participant proceeds? Treat a control as effective without testing or monitoring its operation Grant broad permanent access because the immediate request appears legitimate Evaluate likelihood, impact, existing controls, and business context. Open a suspicious link to determine whether the message is malicious

3For identifying weaknesses, evaluating risk, and selecting treatment, which closeout action provides the strongest evidence of reliable performance? Delete logs and files before the incident record and evidence are preserved Share an encryption key through the same channel as the protected data Accept a vulnerability without recording the owner, rationale, or residual risk Track treatment decisions, owners, due dates, and accepted residual risk.

4During Risk and Vulnerability Management, what is the best response when the result conflicts with expectations? Pause the task involving Risk and Vulnerability Management, reconcile the evidence and requirements, and obtain authorized guidance before proceeding Restore service before confirming containment and required security validation Use one preventive control as a substitute for layered protection and monitoring Forward harmful content widely so coworkers can recognize it

5After work involving identifying weaknesses, evaluating risk, and selecting treatment, what should the complete task record communicate? Keep privileged access after the role or business need has ended Record the facts for Risk and Vulnerability Management, authorized actions, verification results, unresolved risks, and next responsible owner Change incident timestamps to make the response sequence appear complete Collect and retain sensitive data that is not needed for an authorized purpose

Reflection and workplace transferDescribe how you would apply verification and documentation during a CompTIA Security+ task involving identifying weaknesses, evaluating risk, and selecting treatment.

← Return to CompTIA Security+ Education & Occupational Skills Learning Path