A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below: Security Policy 1006: Vulnerability Management 1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities. 2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data. 3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system. According to the security policy, which of the following vulnerabilities should be the highest priority to patch?
Select one answer.
Marked answer: B
Community Discussion
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Chose B1
External (highest priority per policy), high confidentiality impact (highest priority per policy), and fully remote, no privileges, no user interaction (high exploitability).
Chose B1
external facing system is a priority and confidentiality is high, with no availability.
5
This was on my exam yesterday but the questions and names had change.
