350-201 Question 229
Select 3A financial organization has discovered a critical vulnerability in one of its web applications after performing a vulnerability scan. The vulnerability has a CVSS (Common Vulnerability Scoring System) score of 9.8, indicating it is easily exploitable and has a severe impact on confidentiality, integrity, and availability. The organization is uncertain about the next steps for vulnerability triage and risk analysis. What should the security team recommend as the next steps?
- A
Assess the exposure of the affected system and prioritize immediate patching or mitigation based on the CVSS score.
- B
Ignore the CVSS score and wait for confirmation of active exploitation in the wild before taking action.
- C
Perform a business impact analysis to evaluate how the vulnerability might affect organizational objectives.
- D
Verify if compensating controls (e.g., firewalls or intrusion prevention systems) are already mitigating the risk.
- E
Recommend decommissioning the affected system immediately without further analysis.
Show answer and explanation
Correct answers: A, C, D
Explanation
For vulnerabilities with a high CVSS score, it is essential to follow a structured triage and risk analysis process. This includes assessing exposure, prioritizing mitigation, understanding the business impact, and evaluating existing controls to determine the best course of action. Ignoring the CVSS score or taking drastic steps like decommissioning without proper analysis can lead to ineffective or overly disruptive responses.
- A. Correct.
Assessing the exposure and prioritizing patching or mitigation based on the CVSS score is critical for managing high-risk vulnerabilities effectively. This aligns with industry best practices.
- B. Incorrect.
Ignoring the CVSS score and waiting for confirmation of exploitation in the wild is not a recommended practice, as it delays addressing a critical threat and increases the risk of compromise.
- C. Correct.
Performing a business impact analysis helps the organization understand the specific risks and consequences of the vulnerability, allowing for better prioritization and decision-making.
- D. Correct.
Verifying if compensating controls are in place is an important step to determine if additional mitigation is required or if existing defenses are sufficient.
- E. Incorrect.
Decommissioning the system immediately without analysis is an extreme measure and typically not recommended unless the system is already compromised or poses an unacceptable risk that cannot be mitigated.