Question

A retail organization's monthly vulnerability scan flags several findings across its environment. The security manager must decide which to remediate first. The affected systems include: (1) an internal HR workstation with a medium-severity local privilege escalation flaw, (2) a public-facing e-commerce web server in the cardholder data environment (CDE) with a medium-severity TLS misconfiguration, (3) a development server with a critical remote code execution flaw that is isolated on an air-gapped test network, and (4) a marketing kiosk with a low-severity outdated browser plugin. Which finding should be remediated first?

Accepted Answer

The e-commerce web server TLS misconfiguration, because it resides in the PCI DSS cardholder data environment and is internet-facing

Answer

The development server RCE flaw, because it has the highest CVSS base score

Answer

The HR workstation privilege escalation flaw, because privilege escalation always enables lateral movement

Answer

The marketing kiosk plugin, because kiosks are physically accessible to the public