CySA+ v4 · Objective 2.2
Interpreting assessment results
Translate scanner, web, cloud, and control-validation output into claims supported by evidence. Recognise what each tool can establish and choose a proportionate next check.
What you will be able to do
- Distinguish discovery observations, inferred vulnerabilities, confirmed configuration issues, and control-validation results.
- Identify relevant evidence in network, multipurpose, web application, and vulnerability scanner output.
- Correlate deployed cloud settings, infrastructure definitions, and container or dependency results.
- Record confidence, scope limitations, and follow-up verification without overstating findings.
Learn the concepts
- Lesson 1
Read the evidence behind a network or web finding
A finding title compresses a chain of observations and assumptions. Analysts need to reconstruct that chain before assigning ownership, recommending changes, or claiming that a weakness is confirmed.
Open lesson → - Lesson 2
Connect cloud posture, build artefacts, and detection results
Cloud and simulation reports answer different questions from a traditional port scan. Correlating their evidence helps distinguish a risky configuration, a vulnerable component, and a defensive control that failed.
Open lesson →
Apply your judgement · Synthetic scenario
Three tools, one release, conflicting conclusions
A fictional media archive is preparing a new portal release. Its team has a collection of scanner results and wants a single statement that the release is safe.
- Network scan
- TCP 443 open on portal-test; service fingerprint confidence medium; tested without credentials.
- Web assessment
- ZAP completed 42 requests; every response redirects to /login; zero authenticated routes recorded.
- Cloud/build comparison
- Checkov passed revision r18; deployment record still points to r17; Prowler reports a broad storage permission on archive-test.
- Control exercise
- Atomic test status error: prerequisite file missing; no matching detection alert.
Your task
- Classify what each result establishes and what it leaves unknown.
- Select three follow-up activities that reduce uncertainty.
- Draft a release-review conclusion with explicit limitations.
Compare your response
The network result establishes reachability, not vulnerable software. ZAP covered the unauthenticated redirect path and cannot establish authenticated application coverage. The source and cloud reports concern different states. The simulation did not execute its intended behaviour, so zero alerts cannot be interpreted as a detection failure or success.
Run the approved authenticated application workflow with synthetic accounts and confirm route coverage. Reconcile revision r17, revision r18, and the specific storage policy before validating the deployed correction. Fix the simulation prerequisite in the isolated test environment and collect execution, sensor, and alert evidence for the rerun.
Recommend that release owners resolve the observed cloud permission and incomplete assessments before claiming the agreed assurance criteria are met. Keep the network observation as context. Record each remaining gap, owner, and next verification result; a collection of green tool summaries does not replace evidence that the relevant release was assessed.
Put it into practice
Use these labs alongside this module.
Check your understanding
Source reading: supplied book, chapters 5, 6, 7. Lessons, scenarios, and questions are original CyberCorps course material.