Exam CS0-003 All QuestionsBrowse all questions from this exam
Go to Exam
Question 8

A security analyst is tasked with prioritizing vulnerabilities for remediation. The relevant company security policies are shown below:

Security Policy 1006: Vulnerability Management

1. The Company shall use the CVSSv3.1 Base Score Metrics (Exploitability and Impact) to prioritize the remediation of security vulnerabilities.

2. In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data.

3. The Company shall prioritize patching of publicly available systems and services over patching of internally available system.

According to the security policy, which of the following vulnerabilities should be the highest priority to patch?

    Correct Answer: B

    The security policies prioritize confidentiality over availability and external systems over internal ones. Both CAP.SHIELD and THANOS.GAUNTLET have the same CVSS scores with high confidentiality impact, but CAP.SHIELD is on an external system, making it the highest priority to patch according to the policies.

Discussion
kmordalvOption: B

Based on the security policy and the CVSSv3.1 Base Scores, vulnerability B (CAP.SHIELD) with a high impact on confidentiality should be the highest priority to patch. It is an externally accessible system, and since confidentiality takes precedence over availability, it should be addressed before other vulnerabilities.

ms123451Option: B

According to policy, obviously B

user82Option: B

Both B and D have the exact same CVSS 3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N How do ya'll who chose B know for sure Cap.Shield is external and Thanos.Gauntlet is not ?

user82

Nevermind, it won't let me delete my comment. It says external the bottom.

nmap_king_22Option: C

In the Common Vulnerability Scoring System (CVSS), "A:N" stands for "Availability: None." CAPS SHIELD is A:N According to the provided security policy, the highest priority for patching should be given to vulnerabilities that prioritize confidentiality of data over availability of systems and data. If there is a choice between these two factors, confidentiality takes precedence. Additionally, publicly available systems and services should be prioritized over internally available systems. Given these criteria, the vulnerability with the highest priority to patch is: C. Name: LOKI.DAGGER - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H External System

kmordalv

Are you sure? As stated in point 2 "In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data"... This means that confidentiality should be given higher priority than availability. Since confidentiality in answer B is H and in answer C is N (none), the correct answer should be B.

Uncle_Lucifer

NO. Its either B or D. In this case since its external system preference over internal, then B is correct

zee_RiddleOption: B

Answer is B based on the policy.

BanesTechOption: B

Based on the security policy's criteria, vulnerabilities B (CAP.SHIELD) and D (THANOS.GAUNTLET) have the highest priority in patching because they have the highest impact on confidentiality, which takes precedence over availability. B. CAP.SHIELD - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (External System) Exploitability: Low Impact: High (Confidentiality) Patching Priority: Highest D. THANOS.GAUNTLET - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (Internal System) Exploitability: Low Impact: High (Confidentiality) Patching Priority: Highest According to the policy, external systems should be prioritized over internal systems. Therefore, vulnerability B should be addressed first.

BAMMRM

Yes. However, D shouldn't even be considered at this point because it is an INTERNAL system which does not take priority over an external facing one. So it is between B and C. When you look at option B, however, you see: /C:H which means the impact on confidentiality is high. Thus, B is your answer.

RobVOption: B

Answer is B

Uncle_LuciferOption: B

B. Answer came down to B vs D in C and I preference, but the third criteria puts more preference for external system over internal - therefore B.