350-201 Question 230
Select 3A security analyst at your organization has identified a critical vulnerability in an internally hosted web application after performing a vulnerability scan. The CVSS (Common Vulnerability Scoring System) score of the vulnerability is 9.8. What should the analyst recommend as the next steps to effectively triage and analyze the risk?
- A
Verify the vulnerability by testing if it can be exploited in the current environment.
- B
Immediately apply the vendor-provided patch or workaround without further analysis.
- C
Evaluate the business impact of the affected system to prioritize remediation.
- D
Cross-reference the CVSS score with exploit availability and active exploitation reports.
- E
Ignore the vulnerability if no exploitation has been observed in the wild.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective vulnerability triage and risk analysis involve verifying the vulnerability to confirm its presence, assessing the business impact of the affected system, and considering additional threat intelligence such as exploit availability and active exploitation reports. These steps allow organizations to prioritize their remediation efforts properly and avoid unnecessary disruptions.
- A. Correct.
Verifying the vulnerability by testing ensures that the reported issue is not a false positive and provides confirmation that the system is genuinely at risk.
- B. Incorrect.
While applying a patch may address the issue, it should not be done without verifying the vulnerability and evaluating its business impact, as untested patches can introduce additional risks.
- C. Correct.
Evaluating the business impact is crucial for prioritizing remediation efforts, especially for critical vulnerabilities affecting high-value or business-critical systems.
- D. Correct.
Cross-referencing the CVSS score with exploit availability and active exploitation reports can provide additional context for prioritization, such as whether the vulnerability is actively being exploited.
- E. Incorrect.
Ignoring the vulnerability is not a viable option, even if no exploitation has been observed, as the risk still exists and could be exploited in the future.