3. Vulnerability Management (30%)

Vulnerability management is the systematic process of identifying, evaluating, prioritizing, and remediating weaknesses in systems before attackers exploit them. At 30% of the exam — the second largest domain — it demands both technical depth (understanding scanning methods and tool output) and strategic judgment (knowing how to prioritize and respond when you can't fix everything at once).

The core tension in vulnerability management: there are always more vulnerabilities than resources to fix them. The discipline isn't about achieving zero vulnerabilities — it's about ensuring the vulnerabilities most likely to be exploited against your most valuable assets get fixed first, while everything else is tracked and managed.