Which of the following are the MOST important items for prioritizing fixes that should be included in the final report for a penetration test? (Choose two.)
Which of the following are the MOST important items for prioritizing fixes that should be included in the final report for a penetration test? (Choose two.)
The most important items for prioritizing fixes in a penetration test report are the CVSS score of the finding and the network location of the vulnerable device. The CVSS score provides a standardized measurement of the severity of the vulnerability, which is essential for understanding its potential impact. The network location of the vulnerable device helps assess the exposure and criticality of the vulnerability based on where it is situated within the network, as vulnerabilities on critical or highly exposed systems generally require more urgent attention.
A. The CVSS score of the finding and C. The vulnerability identifier. The CVSS score is important for providing an indication of the severity of the vulnerability and its potential impact. The vulnerability identifier is important for providing a way to cross reference the finding with other sources of information and for tracking the progress of remediation efforts.
The vulnerability identifier could be a CVE (Common Vulnerabilities and Exposures) number or a CWE (Common Weakness Enumeration) number. For example, the CVE for a vulnerability in Microsoft Windows is CVE-2019-1458.
It seems to me that the vulnerability score and location should be a priority. I can see the argument for the vuln identifier but it is pointless to have it without knowing wich machine is afected. You could have a 5000 machine network and without the vulnerable machine address all is for nothing.
I agree with AB. I think C is important for remediation but prioritizing fixes involves finding out critical assets and where they are located. You can have a list of CVEs with corresponding CVSS scores and still find yourself wondering where to start.
A B, for sure.
ooops - A & C
A. The CVSS score of the finding B. The network location of the vulnerable device I am starting to notice that multiple selections like this are always together....
A and B Explanation "Exposure of the Vulnerability Cybersecurity analysts should also consider how exposed the vulnerability is to potential exploitation. For example, if an internal server has a serious SQL injection vulnerability but that server is only accessible from internal networks, remediating that issue may take a lower priority than remediating a less severe issue that is exposed to the Internet and, therefore, more vulnerable to external attack."
A or C ithink is correct
A. (CVSS score) Provides a measure of severity without any context. B. (Network location) Provides company-relevant context for that vulnerability
C. (vulnerability Identifier) is needed for remediation, but A. and B. are needed for PRIORITIZATION.
A. The CVSS score of the finding B. The network location of the vulnerable device Explanation: A. The CVSS score of the finding: • The Common Vulnerability Scoring System (CVSS) score provides a standardized way to assess the severity of a vulnerability. Including the CVSS score helps prioritize fixes based on the risk and impact of the vulnerabilities, guiding the client on which issues need immediate attention. B. The network location of the vulnerable device: • The network location of the vulnerable device helps determine the potential impact and risk associated with the vulnerability. For instance, vulnerabilities on critical infrastructure or systems within sensitive segments of the network may need higher priority for remediation compared to those on less critical systems.
AC- both seem to deal with priority. The score and network location to determine if it’s a critical vulnerability
Read the question, and use basic critical thinking skills. The question asks to prioritize fixes. In order to prioritize ANYTHING IN ANY CONTEXT, you need two things: 1) a list of WHAT ITEMS you must prioritize, and 2) a method to QUANTIFY each item on the list A. The CVSS score of the finding [QUANTIFY] C. The vulnerability identifier [WHAT ITEMS]
If you ever take the CySA+ test, it always remediates the external-facing devices first and then the internal ones based on the score. So A and B
AB: The need for the score should be evident but it's also important to know WHERE the weakness resides, e.g. behind a firewall or accessible over the internet
The other options, B, D, E, and F, may have some relevance in the context of the penetration test, but they are not directly related to prioritizing fixes for the identified vulnerabilities.
i check this link idont know A or C 80% A or F 95% I will go with A & F https://cobalt.io/blog/how-to-write-an-effective-pentest-report-vulnerability-reports
A and C is correct answer
A or C A or F ? which answer is correct?
I think A OR F