312-50 Question 117
Single answer▪ Vulnerability Classification and AssessmentDuring an internal vulnerability assessment, a CEH analyst scans a public-facing web application server and finds the following issues: (1) the server supports TLS 1.0 and weak cipher suites, (2) the web application reflects unsanitized user input in a search parameter, and (3) SMB signing is disabled on an internal file server used only by administrators. The analyst must classify findings so the remediation team can prioritize work that most directly reduces immediate risk to the public-facing application. Which finding should be classified as the highest-priority vulnerability for the public-facing application environment?
- A
The reflected unsanitized input in the search parameter, because it indicates a likely reflected cross-site scripting vulnerability in the exposed application
- B
Support for TLS 1.0 and weak cipher suites, because any deprecated cryptographic protocol is automatically more critical than application-layer flaws
- C
Disabled SMB signing on the internal file server, because it could allow relay attacks and therefore outweighs issues on the public web server
- D
All three findings should be given the same priority because they were discovered in the same assessment cycle
Show answer and explanation
Correct answer: A
Explanation
This question tests practical vulnerability classification and assessment rather than simple identification. In real-world triage, analysts do not prioritize solely by scanner output or by the presence of any cryptographic weakness. They assess context: whether the asset is public-facing, whether the issue is directly exploitable, and what impact exploitation would have. Here, the likely reflected XSS is the highest-priority issue because it exists in the exposed application itself and can be used against real users immediately. By contrast, TLS 1.0 and weak ciphers are configuration weaknesses that may still be important for compliance and risk reduction, but they do not inherently outrank an actively exploitable input-validation flaw. Similarly, disabled SMB signing may be a valid internal risk, but it is not the top remediation item for the public-facing web application. This aligns with common industry guidance from OWASP on prioritizing exploitable web application risks and with CVSS-style thinking that considers attack vector, scope, and impact when assessing severity.
- A. Correct.
Correct. Reflected unsanitized input in a search parameter is a strong indicator of reflected cross-site scripting (XSS), which directly affects the public-facing application and can often be exploited immediately through crafted links or requests. In vulnerability classification and assessment, direct exploitability, exposure, and business impact are key factors. Because this flaw exists in an Internet-accessible application and can affect user sessions, content integrity, and trust, it is typically prioritized above weaker but more contextual infrastructure issues.
- B. Incorrect.
Incorrect. Supporting TLS 1.0 and weak ciphers is a valid vulnerability and should be remediated, but it is not automatically more critical than an application-layer flaw such as XSS. Severity depends on exploitability, compensating controls, data sensitivity, client requirements, and actual attack impact. Deprecated crypto is often classified as a configuration weakness, whereas exploitable XSS can provide a more immediate path to session theft, phishing, or browser-based attacks against users of the live application.
- C. Incorrect.
Incorrect. Disabled SMB signing can be important in an internal environment because it may enable certain man-in-the-middle or relay scenarios, but the question asks for the highest-priority issue for the public-facing application environment. This finding is on an internal administrative file server, so its exposure and relevance to the Internet-facing application are lower in this prioritization decision. A common mistake is to rank a technically serious issue higher without considering scope and exposure.
- D. Incorrect.
Incorrect. Findings discovered in the same assessment do not receive equal priority by default. Vulnerability assessment requires classification by factors such as asset criticality, attack surface, exposure, likelihood of exploitation, and potential impact. Treating all findings equally is poor triage practice and delays remediation of the issues that present the greatest immediate risk.