Question

A security analyst is reviewing vulnerability scan results for the company's environment. Two findings must be prioritized for remediation: Finding 1 has a CVSS base score of 9.8 but affects an isolated internal test server with no network access to production. Finding 2 has a CVSS base score of 7.5 and affects a customer-facing web server that processes payment data. Company risk tolerance is low, and PCI DSS compliance is required. Which finding should the analyst remediate first, and why?

Accepted Answer

Finding 2, because environmental variables and organizational impact raise its effective risk despite the lower base score

Answer

Finding 1, because its higher CVSS base score indicates greater technical severity

Answer

Finding 1, because a score above 9.0 is always classified as critical and must be patched immediately

Answer

Finding 2, because a lower CVSS base score is easier and faster to remediate