Question

A vulnerability scanner reports a critical flaw (CVSS Base score 9.1) on 40 servers across the enterprise. During triage, the SOC analyst discovers that 35 of these servers are internal-only development boxes containing no sensitive data, while 5 are internet-facing systems processing customer financial transactions. Company policy requires prioritizing remediation using industry scoring systems. What should the analyst do to most accurately re-prioritize these findings for risk analysis?

Accepted Answer

Apply the CVSS Environmental metric group to adjust scores based on each asset's confidentiality, integrity, and availability requirements and modified attack surface

Answer

Treat all 40 servers as equal priority since they share the same 9.1 Base score and patch them in the order they were discovered

Answer

Recalculate the CVSS Base score for each server to lower the values on the development boxes

Answer

Use only the CVSS Temporal metrics to reflect current exploit maturity across all servers