mediumMultiple SelectObjective-mapped
CS0-003 Practice Question: A security analyst is reviewing the results of a…
A security analyst is reviewing the results of a recent vulnerability scan. The analyst needs to prioritize remediation efforts effectively. Which four of the following factors should the analyst consider when prioritizing vulnerabilities? (Choose four.)
⚠ Common exam trap
CompTIA often tests that candidates confuse the number of patches or visual indicators (like color) with actual risk factors, leading them to select those distractors instead of focusing on exploitability, asset value, and standardized scoring.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Common Vulnerability Scoring System (CVSS) base score
The Common Vulnerability Scoring System (CVSS) base score provides a standardized numerical rating (0-10) of a vulnerability's severity, factoring in exploitability and impact metrics. This score helps analysts compare vulnerabilities across different systems and prioritize those with higher potential damage. It is a foundational input for risk-based prioritization, not the sole deciding factor.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The Common Vulnerability Scoring System (CVSS) base score
Why this is correct
The CVSS base score provides a reproducible, quantitative measure of a vulnerability's intrinsic severity, factoring in exploitability and impact metrics such as attack vector and confidentiality loss. It serves as a standardized starting point for prioritization, enabling analysts to compare disparate vulnerabilities on a common scale.
- ✓
The age of the vulnerability since its public disclosure
Why this is correct
The age since public disclosure indicates how long the vulnerability has been known and available to both vendors and attackers. Older vulnerabilities are more likely to have mature exploit code and to have been incorporated into threat actor toolkits, so they generally deserve expedited remediation.
- ✗
The number of times a vendor has released a patch for the vulnerability
Why it's wrong here
The number of vendor patch releases is irrelevant because a vendor may issue multiple patches for a single vulnerability due to regressions, additional fix revisions, or rolling support, none of which change the underlying severity or exploitability. Patch count is a maintenance statistic, not a risk metric.
- ✓
The existence of publicly available exploit code
Why this is correct
The existence of publicly available exploit code is a critical threat indicator because it lowers the barrier to exploitation, allowing even unskilled attackers to compromise the target. This is often incorporated into temporal scoring and matches concepts like the CISA Known Exploited Vulnerabilities catalog.
- ✓
The asset's criticality to the organization's mission
Why this is correct
Asset criticality reflects the mission impact if the system is compromised, so a vulnerability on a low-scoring but business-critical system may be more urgent than a higher-scoring vulnerability on an isolated asset. This context ensures remediation aligns with organizational risk tolerance and operational priorities.
- ✗
The color of the vulnerability in the scan report
Why it's wrong here
The color of a vulnerability in a scan report is merely a visual representation of the severity band derived from a scoring system, not an independent criterion. Colors can vary by scanner and are not a decision factor in themselves; they simply summarize other metrics.
Go deeper
Related to this question
Learn chapter
Vulnerability Scanning Techniques
Key term
CVSS
The Common Vulnerability Scoring System (CVSS) is a standardized framework used to rate the severity of security vulnerabilities on a scale from 0 to 10.
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
About these practice questions
One of 236 original CS0-004 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CS0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CS0-004 exam.