Objective 4.3: Explain various activities associated with vulnerability management
Security+ SY0-701 practice question
A vulnerability scan returns two findings, and the team can remediate only one before a weekend change freeze. Finding 1 has a CVSS base score of 9.1 and affects a lab server that has no network path to production and holds no sensitive data. Finding 2 has a CVSS base score of 7.5 and affects the internet-facing payment portal, and a threat intelligence feed reports that it is being actively exploited. Which action BEST reflects sound vulnerability prioritization?
- Remediate Finding 1 first, because the CVSS base score is the most reliable measure of risk
The base score ignores environmental context. A 9.1 on an isolated lab server with no sensitive data and no path to production carries much less real risk than an actively exploited flaw on an internet-facing payment system.
- Remediate Finding 2 first, because its exposure and active exploitation outweigh its lower base score(Correct)
Correct. Finding 2 is exposed to the internet, protects payment data, and is being exploited right now. Those environmental and threat factors make it the higher risk despite the lower base score.
- Defer both findings until a rescan confirms that neither one is a false positive
Confirming findings is part of analysis, but deferring an actively exploited vulnerability on an internet-facing payment portal leaves the organization exposed through the entire freeze. Any validation should happen quickly, not as a reason to delay remediation.
- Schedule both findings for the first maintenance window after the change freeze ends
Waiting for the next maintenance window treats both findings as equally urgent and leaves an actively exploited flaw on the internet-facing payment portal open for the whole freeze. The team has capacity to fix one finding now, and the riskiest one should use it; Finding 1 can safely wait for the post-freeze window.
Explanation
The CVSS base score describes a vulnerability's severity in general, not the risk to your organization. Prioritization must also weigh environmental factors (is the system exposed, what data does it hold, how critical is it), threat intelligence (is it being exploited in the wild), and the organizational impact. An actively exploited flaw on an internet-facing payment system is far more urgent than a higher-scored flaw on an isolated system with no sensitive data.