Validated, or Not Yet? — TechKnowSurge

About this interactive

The Validation of Remediation lesson says a fix is not done until it is shown to work. The simplest way is to repeat whatever found the flaw. If a vulnerability scan found it, rerun the scan and check the finding is gone. If a pen test found it, there are two ways: the report usually explains how to reproduce the flaw, so you repeat those steps and see that they now fail; or the contract gives the testers a retest after a set time to fix, and they come back and confirm it. Things that happen on the way to a fix are not validation on their own: a patch being installed, a ticket being closed, an approval, or a vendor saying its update fixes the flaw. A patch can be installed and still not work, for example while the server waits for a reboot. A quick test for each card: has someone repeated the test that found the flaw and seen it fail?

What you'll learn

Decide whether a fix has been validated: shown to work by repeating the method that found the flaw, such as a rescan, reproducing the pen test report's steps, or the testers' retest
Recognize that an installed patch, a closed ticket or a vendor's note is not yet validation

Aligned to

CompTIA Security+

4.3 Explain various activities associated with vulnerability management.

CompTIA CySA+

2.5 Explain concepts related to vulnerability response, handling, and management.

NIST 800-53

CA-8 Penetration Testing

RA-5 Vulnerability Monitoring and Scanning

Key terms

Vulnerability Scan Rerun: The process of executing a vulnerability scan a second time after remediation to confirm that a previously identified vulnerability has been successfully resolved.
Retesting: A follow-up assessment performed by a penetration tester after a vulnerability has been remediated, confirming that the fix is effective and the vulnerability no longer exists.
Penetration Testing: An authorized simulated attack on a system to identify and evaluate security vulnerabilities.

Topics

Vulnerability Management Validation Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →