Question

A CySA+ analyst reviews a vulnerability scan report that flags a critical CVE on a Windows Server. The scanner detected the vulnerability by matching only the OS build number, but the organization applied an out-of-band hotfix that patched the flaw without incrementing the build. Before escalating this to the emergency change board, what is the MOST appropriate action for the analyst to take?

Accepted Answer

Cross-reference the finding against the host's installed patch registry and file version metadata to confirm whether the vulnerability actually exists

Answer

Immediately accept the risk and document it in the risk register since the build number confirms the exposure

Answer

Increase the CVSS environmental score to force the finding into a higher remediation SLA tier

Answer

Disable the scanner plugin that produced the finding to prevent it from recurring in future scans