Vulnerability management · Question 11 of 12
A scan finds two vulnerabilities: CVSS 9.8 on an isolated test server without data, and CVSS 7.5 on the public web shop, for which the CISA KEV catalog lists active attacks. Which is fixed first?
1 answer is correct. Hard
Show answer
Answer
- B The one in the web shop, because it is actively exploited and exposed
Explanation
Priority results from severity, exploitation and the importance of the system. A publicly reachable, business-critical shop with an actively exploited vulnerability is acutely at risk. The isolated test server is fixed afterwards. A finding is only dismissed as a false positive after it has been checked.