Question

A security analyst has completed a vulnerability scan of the organization's web servers and identified 247 vulnerabilities. The scan results show vulnerabilities with CVSS scores ranging from 2.1 to 9.8. Management has requested that critical issues be addressed first, but the team has limited resources. Which approach should the analyst use to prioritize remediation efforts?

Accepted Answer

Focus on vulnerabilities with CVSS scores of 9.0 or higher, then assess environmental variables and organizational impact for final prioritization

Answer

Address all vulnerabilities in ascending order by CVSS score to build momentum with quick wins before tackling complex issues

Answer

Remediate only vulnerabilities that have active exploit code available in public repositories, regardless of CVSS score

Answer

Patch all vulnerabilities on internet-facing servers first, then address internal vulnerabilities based on discovery date