Domain 2 · Objective reference 2A2 · Chapter 8 of 35
Analyze vulnerabilities and control deficiencies
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: A weakness and a business risk are related but different.
Explore the anchors
Identify a vulnerable condition.
Concept matching activity
Match this task or description to its concept:
Determine missing or ineffective protection.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Check the safeguards
Management concept and decision mechanism
A vulnerability is a weakness relevant to a failure scenario. A control deficiency may concern design, implementation or operation. Distinguish these so remediation addresses the actual condition. A documented policy does not show it was implemented, and installation does not show the control operated over the assessment period. Validate tool findings against deployment context, reachability and evidence. Assess dependencies and common causes rather than treating every failed test as an isolated user mistake. Report the observed condition, consequence, confidence and limits without implying successful exploitation that was never demonstrated.
Check the safeguards
Distinguish a safeguard described in a policy from one operating in practice. Review access records, configuration, testing, and known failures. A backup job marked successful does not prove that the business service can be restored.
Record evidence, assessment date, owner, current exposure, and the confidence in your conclusion. A lack of evidence should trigger investigation or a stated limitation, not an automatic low-risk rating. Reassess when important assumptions change.
Worked example
A server version matches an advisory, but the team verifies the deployed fix and reachable behavior before labeling it exploitable.
Check your understanding
How do design and operating deficiencies differ?
Show explanation
Design is inadequate to meet the objective; an operating deficiency means an otherwise suitable control did not perform as required.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.