Question

A vulnerability analyst is reviewing scan results for two servers. Both are affected by a vulnerability with a CVSS v3.1 base score of 9.8 (Critical). Server A is an internet-facing web server hosting the customer payment portal, and a public proof-of-concept exploit is confirmed to be circulating in the wild. Server B is an internal test server with no sensitive data, isolated on a segmented lab VLAN with no external access, and no known exploit exists for its specific configuration. Management wants the analyst to prioritize remediation using more than the base score alone. Which approach BEST reflects proper risk-based prioritization?

Accepted Answer

Prioritize Server A first by applying temporal (exploit maturity) and environmental (asset value, exposure) metrics that raise its contextual risk above Server B

Answer

Remediate both servers with equal urgency because they share the identical 9.8 base CVSS score

Answer

Prioritize Server B first because internal systems are inherently more trusted and any compromise indicates an insider threat

Answer

Defer both until the next quarterly maintenance window since the base score does not distinguish between the two assets