Question

During a busy shift, a SecOps engineer opens Security Command Center Premium and sees 40+ active findings across projects. Two findings stand out: (1) a HIGH-severity 'Public IP address' finding on a development VM that hosts no sensitive data and sits in an isolated project, and (2) a MEDIUM-severity 'Over-privileged service account' finding on an account that, according to the attack path in SCC, has a viable route to a Crown Jewel BigQuery dataset containing regulated customer PII. Analyst time is limited. Which finding should be triaged and remediated first, and on what basis?

Accepted Answer

The MEDIUM-severity service account finding, because its SCC attack path shows exploitable exposure to a high-value asset, making real business risk higher than the isolated HIGH finding.

Answer

The HIGH-severity public IP finding, because SCC severity labels are the authoritative ranking for triage order.

Answer

The HIGH-severity public IP finding, because any internet-exposed resource is by definition the greatest risk regardless of the asset it hosts.

Answer

Neither yet; both should be left open until every finding in all projects is enumerated so a fully ranked list can be produced before acting.