200-201 Question 328
Select 3A cybersecurity analyst at your organization has identified a critical vulnerability in one of the web servers during a routine scan. The vulnerability has a CVSS score of 9.8 and is actively being exploited in the wild. What should the analyst's next steps include as part of the vulnerability management process?
- A
Immediately prioritize and apply the appropriate patch to mitigate the vulnerability.
- B
Document the vulnerability and wait for the next scheduled maintenance window to address it.
- C
Verify the scope of the vulnerability and identify all affected systems in the network.
- D
Report the vulnerability to the software vendor and wait for guidance before taking action.
- E
Deploy a temporary workaround, such as disabling the vulnerable service or applying access control, if patching is not immediately possible.
Show answer and explanation
Correct answers: A, C, E
Explanation
Effective vulnerability management involves prioritizing the remediation of critical vulnerabilities, especially those actively being exploited. This includes applying patches promptly, identifying the scope of the impact, and implementing temporary workarounds if immediate patching is not feasible. Delayed action or waiting for vendor guidance can leave systems exposed, making it imperative to address the issue proactively.
- A. Correct.
Immediately prioritizing and applying the patch is essential for addressing critical vulnerabilities with a high CVSS score, especially if it is being actively exploited.
- B. Incorrect.
Waiting for the next scheduled maintenance window is not advisable for critical vulnerabilities that pose an immediate risk, as this could leave the system exposed.
- C. Correct.
Verifying the scope of the vulnerability and identifying affected systems ensures that all impacted assets are addressed during mitigation efforts.
- D. Incorrect.
While reporting vulnerabilities to the vendor is a good practice, waiting for vendor guidance is not suitable for critical, actively exploited vulnerabilities as it could delay mitigation.
- E. Correct.
Deploying a temporary workaround is a valid response when patching cannot be done immediately, as it helps reduce the risk of exploitation until a proper fix is applied.