CS0-004 - Vulnerability Management (26% of the exam) - Section 2.3
Given a scenario, analyze data to prioritize and mitigate vulnerabilities.
Prioritise remediation using more than the raw CVSS base score: exploitability and active exploitation (EPSS, KEV), asset criticality and exposure, data sensitivity, and compensating controls. Recommend mitigation - patching, configuration change, segmentation, or compensating control - proportionate to real risk and business context rather than severity alone.
CVSS base, temporal and environmentalEPSS and CISA KEVasset criticality and exposurecompensating controlsrisk-based prioritisation
Two findings compete for the same maintenance window. Finding 1: CVSS 9.8 remote code execution on a development sandbox with no inbound internet exposure and no sensitive data. Finding 2: CVSS 7.2 privilege escalation on the production payroll server holding regulated staff records, with a public proof-of-concept available. Which finding should the analyst prioritise, and why?
AFinding 1, because its 9.8 base score outranks the 7.2 and the highest CVSS should always be remediated first.
BFinding 2, because asset criticality, regulated data, and a working proof-of-concept make it the greater real-world risk.check_circle Correct
CFinding 1, since a remote code execution flaw is inherently more damaging than any privilege-escalation flaw regardless of location.
DNeither yet; defer both until a fuller environmental CVSS re-score is completed for every asset in the estate.
Prioritise remediation using asset criticality, data sensitivity, and exploit availability rather than the raw CVSS base score. Effective prioritisation weights environmental factors such as exposure, business criticality, regulated data, and a proven exploit; these can make a lower-scored production finding a higher real risk than a higher-scored flaw on an isolated non-exposed sandbox.
Why A is wrong: Tempting because 9.8 exceeds 7.2, but base CVSS ignores exposure and asset value; treating the raw score as the sole ranking factor is the classic prioritisation error.
Why B is correct: Environmental context wins: a lower-scored flaw on an exposed, regulated, business-critical asset with a public exploit carries more real risk than a higher score on an isolated sandbox.
Why C is wrong: RCE can be severe, but severity depends on where it lives; an isolated sandbox with no exposure or data limits impact well below the exposed payroll server.
Why D is wrong: Re-scoring can refine ranking, but the evidence already shows a clear winner; deferring an exposed, exploitable, regulated-data finding to await a full re-score wastes the window.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CS0-004 bank for this domain.
Remediate strictly in descending base-score order but shorten each finding's remediation deadline by half.
errorWhy it is wrong: Compressing deadlines keeps the same flawed ordering that already let a lower-scored but exploited finding slip; faster work on the wrong sequence does not fix the ranking problem she raised.
Finding 1, because its 9.8 base score is critical and base severity is the primary driver of remediation order.
errorWhy it is wrong: Treating the raw base score as the sole driver is the classic prioritisation error; it ignores that the isolated asset has almost no exploitation likelihood and no exposure, so the 9.8 overstates real risk here.
Finding 2, because a CVSS base score of 9.8 is higher and base score is the definitive measure of remediation urgency.
errorWhy it is wrong: Ranking purely by base score is a common mistake, but CVSS base omits exploitability in the wild and asset context, so the isolated host is lower actual risk.