Question

A CySA+ analyst is finalizing a quarterly vulnerability report for the IT operations team, who are responsible for executing remediation. A draft section reads: "Server WEB-07 is running an outdated version of Apache with multiple known CVEs, and the patch cadence for this system appears inconsistent." The operations manager complains that the report tells them what is wrong but not what to do. Which revision best improves the report for this technical, remediation-focused audience?

Accepted Answer

Upgrade Apache on WEB-07 to version 2.4.58 or later within the 30-day SLA for high-severity findings, then rerun an authenticated scan to confirm closure; assign the task to the web server team.

Answer

Add a paragraph explaining the business risk and potential financial impact of a web server compromise to justify prioritization to executives.

Answer

Include the full raw scanner output and CVSS vector strings for each CVE so the team can independently assess the technical details.

Answer

State that WEB-07 represents an unacceptable level of residual risk and recommend the system be decommissioned pending a formal risk-acceptance decision.