350-201 Question 231
Select 2A cybersecurity analyst is reviewing a vulnerability report for a web application used by the organization. The report highlights a critical vulnerability with a CVSS score of 9.8 that could allow remote code execution. The application is hosted on a server that is part of the production environment and publicly accessible. However, the analyst also discovers that access to the web application is restricted to authenticated users. What should the analyst recommend as the next steps for vulnerability triage and risk analysis?
- A
Immediately patch the vulnerability to mitigate the risk.
- B
Perform a detailed risk analysis by considering exploitability and asset value.
- C
Temporarily restrict access to the application to internal users only until patched.
- D
Validate the vulnerability by attempting to reproduce it in a controlled environment.
- E
Ignore the vulnerability since it requires authentication and is less likely to be exploited.
Show answer and explanation
Correct answers: B, D
Explanation
When triaging a vulnerability, it is crucial to assess its actual risk to the organization by considering its exploitability, asset value, and business impact. Validating the vulnerability ensures that it's not a false positive and helps prioritize remediation efforts. While patching and restricting access can be part of the remediation plan, they should be preceded by a systematic risk analysis and validation to avoid unnecessary disruptions or incomplete risk mitigation.
- A. Incorrect.
Immediately patching the vulnerability may not always be feasible, especially in production environments, as it could disrupt services. A more systematic approach is required.
- B. Correct.
Performing a detailed risk analysis helps determine the true impact of the vulnerability by considering factors such as exploitability, asset value, and business impact.
- C. Incorrect.
Restricting access might be a temporary workaround but is not a sustainable solution. It may also not align with the organization’s operational requirements.
- D. Correct.
Validating the vulnerability in a controlled environment ensures that the issue is real, reproducible, and understood, which is critical for appropriate remediation planning.
- E. Incorrect.
Ignoring the vulnerability is not a recommended practice, even if it requires authentication, as attackers could potentially find ways to exploit it.