GEVA Exam Prep

What you will be able to do

• You will be able to describe the vulnerability management lifecycle and place it inside recognized frameworks such as NIST SP 800-40 and CIS Control 7.
• You will be able to distinguish the SCAP enumerations (CVE, CWE, CPE, CVSS) and explain what each one identifies.
• You will be able to scope and perform asset discovery using active and passive techniques to build a trustworthy inventory.
• You will be able to configure and run credentialed and uncredentialed vulnerability scans while controlling false positives and avoiding disruption.
• You will be able to prioritize findings using CVSS, EPSS, the CISA KEV catalog, and business context rather than severity alone.
• You will be able to choose appropriate risk treatments (remediate, mitigate, transfer, or accept) and set remediation SLAs.
• You will be able to produce audience-appropriate reports and program metrics that measure and improve a vulnerability management program.

What is inside

5 modules, 5 lessons. Each module ends in a graded quiz.

1. 01

   Vulnerability management frameworks

   How the vulnerability management lifecycle works and the frameworks, standards, and enumerations that structure it, from NIST SP 800-40 and CIS Control 7 to the SCAP family of CVE, CWE, CPE, and CVSS.

   1 lessons · 5 quiz questions

2. 02

   Discovery & asset inventory

   Building a trustworthy inventory is the foundation of assessment. This domain covers scoping, active and passive discovery techniques, host and service enumeration, and keeping inventory current across on-prem and cloud.

   1 lessons · 5 quiz questions

3. 03

   Scanning & assessment

   Running vulnerability scans well: scanner types, credentialed versus uncredentialed scanning, tuning for accuracy, confirming findings, and scanning safely across fragile and specialized environments.

   1 lessons · 5 quiz questions

4. 04

   Prioritization & risk

   Turning raw findings into a ranked, defensible remediation list using CVSS correctly, exploit and threat intelligence (EPSS, CISA KEV), business context, and risk-treatment decisions.

   1 lessons · 5 quiz questions

5. 05

   Reporting & program management

   Communicating results so they drive action: audience-tailored reports, actionable remediation guidance, program metrics and KPIs, and closing the loop with verification and continuous improvement.

   1 lessons · 5 quiz questions