3.2. Vulnerability Assessment Tool Output

💡 First Principle: Vulnerability scanner output is raw data — the analyst's job is to interpret it in context, validate findings, and translate them into prioritized actions that reflect real organizational risk rather than just CVSS scores.

Every scanner has false positives, coverage gaps, and format quirks. Reading scanner output critically — questioning whether a finding is real, whether the CVSS score reflects actual risk in your environment, and whether remediation is feasible — is the applied skill the exam tests. Knowing tool names is necessary but insufficient; knowing what their output means and how to act on it is what the exam rewards.

⚠️ Common Misconception: A high CVSS score automatically means the vulnerability needs immediate patching. CVSS measures inherent severity in isolation — it doesn't account for whether the vulnerable service is exposed, whether compensating controls exist, or whether the asset is business-critical. Context transforms CVSS scores into risk priorities.