Study Cisco CCST Cybersecurity vulnerability and risk management: weaknesses, threats, exposure, likelihood, impact, remediation, mitigation, CVE, and CVSS.
Vulnerability and Risk Management is where CCST Cybersecurity shifts from vocabulary to prioritization. The best answer is rarely “fix the highest number first” without considering exposure and business impact.
| Term | Meaning |
|---|---|
| Vulnerability | weakness that could be exploited |
| Threat | actor, event, or condition that could cause harm |
| Exploit | method that uses a vulnerability |
| Exposure | how reachable or accessible the weakness is |
| Impact | harm if the weakness is exploited |
| Risk | likelihood and impact together |
| Remediation | fix or remove the weakness |
| Mitigation | reduce risk when full remediation is not immediate |
| Finding | Better priority instinct |
|---|---|
| critical vulnerability on internet-facing system | high priority because exposure is high |
| high vulnerability on isolated lab host | consider lower operational priority if compensating controls exist |
| medium vulnerability with active exploitation | may outrank a higher score with no exposure |
| unsupported system | segmentation, compensating control, replacement, or migration plan |
| repeated finding | process or ownership problem, not just one missing patch |
A CVE identifies a publicly known vulnerability. CVSS gives a severity score, but CCST questions usually expect context: is the asset exposed, critical, exploitable, protected by controls, or already showing signs of compromise?
| Scenario | Better term |
|---|---|
| install vendor patch that removes the weakness | remediation |
| disable vulnerable service | remediation or mitigation depending on permanence |
| add firewall block until patch window | mitigation |
| isolate legacy system until replacement | mitigation |
| replace unsupported software | remediation |