FirstTry

Objective 2.1

CS0-003

Given a scenario, implement vulnerability scanning methods and concepts.

Objective 2.1 sits in Vulnerability Management, which carries 30% of the CySA+ exam. The questions below are original, written from the official objective title above, and each explanation cites the CompTIA page it rests on.

Objective title verbatim from the official objectives. CompTIA exam page ↗

A worked example

Shown solved, with the whole explanation open: this is what every question here carries.

2-1Vulnerability Management

You are asked to inventory a /16 that may hold only a few hundred live machines, and scanning every port of every address would take days. What does host discovery accomplish first?

Reducing IP ranges to active hostsCorrect · your answerCorrect: discovery narrows address ranges to the hosts that are alive.
Enumerating every service versionService versions come later, from version detection against live hosts.
Cracking authentication on live hostsDiscovery solicits responses; it makes no authentication attempts.
Mapping application dependenciesDependency mapping is an architecture exercise, not a network probe.

Correct.

Checked against nmap.org, August 2026

Concept

Scanning begins by finding what is actually there. Probing every port of every possible address wastes time on empty space, so discovery first narrows the field to targets that respond.

Why A

The guide describes host discovery as reducing a set of IP ranges into a list of active or interesting hosts, since scanning every port of every IP is slow and usually unnecessary.

Source

One of the very first steps in any network reconnaissance mission is to reduce a (sometimes huge) set of IP ranges into a list of active or interesting hosts. Scanning every port of every single IP address is slow and usually unnecessary.

Nmap reference guide, host discovery, checked August 2026
#nmap#asset-discovery#scanning

Now you: objective 2.1 questions

No account needed. The explanation opens when you answer.

Sample question 1 of 3

2-1Vulnerability Management

An analyst wants only a list of which addresses in 10.20.0.0/16 are up, with no ports touched afterward. Which nmap option fits?

Sample question 2 of 3

2-1Vulnerability Management

A DMZ firewall drops all ping probes, so live servers show as down and get skipped. Which nmap option forces a port scan of every target address anyway?

Sample question 3 of 3

2-1Vulnerability Management

A privileged nmap run with no discovery options sweeps a remote subnet. Which probes does it send by default?

Full CySA+ question bank coming

We’re writing the complete bank from the official objectives right now. Leave your email and we’ll tell you when it ships, nothing else, ever.

Read the sources

These are the official pages the questions above cite. Reading them is studying the objective from the primary source, which is what the explanations point you toward anyway.

More objectives in Vulnerability Management