SY0-701 Question 299
Single answerA security analyst at a healthcare company reviews the latest vulnerability scan results. The scanner reports CVE-2023-XXXX on 200 Windows workstations with a base CVSS score of 9.8. The analyst confirms through vendor documentation that the vulnerability affects only a specific service that is disabled on the company's workstation image. At the same time, a separate scan finding with a base CVSS score of 7.5 affects an internet-facing patient portal that stores regulated health information and is known to be actively exploited in the wild. The organization has a low risk tolerance for patient-data exposure and service outages. Which action should the analyst take FIRST?
- A
Prioritize remediation of the internet-facing patient portal finding and document the workstation finding as a confirmed false positive after validation
- B
Prioritize remediation of the workstation finding because the CVSS base score is higher, and defer the patient portal issue until the next maintenance cycle
- C
Close both findings because CVE identifiers alone do not prove exploitability in the organization's environment
- D
Escalate the workstation finding as a likely false negative and rescan the patient portal after patching the workstations
Show answer and explanation
Correct answer: A
Explanation
The best answer is to remediate the patient portal issue first and document the workstation result as a false positive. Vulnerability analysis is not just matching CVEs to systems; it requires confirmation and classification of findings, followed by prioritization based on business and technical context. CVSS provides a standardized severity framework, but the CVSS base score must be supplemented by environmental considerations such as whether the asset is internet-facing, whether sensitive data is involved, exploit activity, compensating controls, and the organization's risk tolerance. In this scenario, the workstation finding was validated against vendor documentation and local configuration, so it should be classified as a confirmed false positive. The patient portal finding has a lower base score but a higher practical risk because of exposure, healthcare data sensitivity, and likely operational and regulatory impact. This aligns with common best practices from NIST vulnerability management guidance and FIRST's CVSS documentation, which emphasize that environmental metrics and business context influence remediation priority.
- A. Correct.
Correct. This response reflects proper vulnerability analysis and prioritization. The analyst has already performed confirmation by checking vendor documentation and the system configuration, showing the workstation result does not apply in the current environment and is therefore a false positive. The patient portal issue should be prioritized because environmental variables matter: it is internet-facing, handles regulated healthcare data, is actively exploited, and the organization has a low risk tolerance for confidentiality and availability impacts. Security+ expects candidates to understand that CVSS base score alone does not determine remediation priority.
- B. Incorrect.
Incorrect. This option reflects the common misconception that the highest base CVSS score should always be remediated first. In practice, prioritization must consider exposure factor, asset criticality, industry and organizational impact, threat intelligence, and environmental context. An internal workstation finding that has been confirmed not to apply is lower priority than a real vulnerability affecting an exposed patient portal.
- C. Incorrect.
Incorrect. While a CVE identifier does not by itself prove exploitability in every environment, the analyst has already confirmed one finding as a false positive and has enough evidence that the patient portal issue is real and relevant. Closing both findings would ignore proper confirmation and risk-based prioritization.
- D. Incorrect.
Incorrect. A false negative is when a tool fails to identify an issue that actually exists. The workstation issue was detected by the scanner but determined not to be applicable, which is a false positive, not a false negative. This option also misprioritizes effort away from the higher-risk, externally exposed portal.