Questão 31 — CompTIA SY0-701 CompTIA Security+ Certification Exam
A vulnerability management team is prioritizing remediation efforts for a large number of reported vulnerabilities. They use the Common Vulnerability Scoring System (CVSS) to evaluate severity, but they also consider whether each vulnerability has a known public exploit, whether it affects internet-facing systems, and the business criticality of affected systems. Which approach does this represent?
- A. Using CVSS scores as the sole determinant of remediation priority, as scoring is comprehensive enough to account for all factors.
- B. Risk-based vulnerability management, which contextualizes technical severity with exploitability, exposure, and business impact.
- C. Compliance-driven patching, which requires all vulnerabilities to be addressed within a fixed timeframe regardless of risk.
- D. Vulnerability scanning without follow-up assessment, which reports all vulnerabilities equally.
Resposta correta:
B
Explicação
Explanation: Correct answer: B. Risk-based vulnerability management, which contextualizes technical severity with exploitability, exposure, and business impact. Risk-based vulnerability management goes beyond raw technical severity scores by incorporating environmental context such as exploitability, system exposure, and business criticality. A high-CVSS vulnerability on an internal, non-critical system might receive lower priority than a lower-CVSS vulnerability on an internet-facing critical system with known exploits. This approach allocates remediation resources more efficiently. Option A incorrectly suggests CVSS alone is sufficient (it is not - context matters). Option C describes a checkbox compliance approach that ignores risk prioritization. Option D is not a systematic approach at all.
Quer todas as 907 questões por R$ 1,00?