CS0-003 Vulnerability Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The CVSS base score

  Why it's wrong here

  The CVSS base score is a useful, standardized severity metric, but it is calculated in a vacuum and does not incorporate any context about how the vulnerability is exploited in the wild or what business assets it affects. A high CVSS score does not automatically mean the vulnerability should be remediated first; attackers often chain lower-severity weaknesses in ways that bypass the score's assumptions. Prioritization must blend CVSS with threat intelligence and the specific value of the target system to the organization.

• ✓

  The asset's criticality to the business

  Why this is correct

  Asset criticality is the correct primary driver for prioritization because it directly captures the potential business impact if confidentiality, integrity, or availability is compromised. A vulnerability on a server that processes financial transactions or contains protected health information poses far greater risk than the same CVE on an internet-facing demo server with no sensitive data. This aligns with risk-based vulnerability management, where risk equals the likelihood of exploitation multiplied by the consequence to the business.

• ✗

  The availability of a patch

  Why it's wrong here

  The availability of a patch is a remediation constraint, not a prioritization factor; you first determine which vulnerabilities pose the greatest risk, then you decide how to address them based on whether a patch, workaround, or compensating control exists. A vulnerability with no available patch may actually be higher priority because it requires immediate mitigation planning, such as network segmentation or enhanced monitoring. Prioritization answers 'what matters most,' while patch availability answers 'how can we fix it.'

• ✓

  Whether the vulnerability is listed in the CISA KEV catalog

  Why this is correct

  Inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog is a correct, high-priority signal because it means the vulnerability has been observed exploited in real-world attacks, not just theoretically scored. This evidence-driven intelligence overrides CVSS-only approaches, as many KEV entries have low or medium base scores yet are actively weaponized by threat actors. An exploitable-in-the-wild vulnerability on a critical asset should take precedence over a 'critical' CVSS vulnerability with no known exploitation.

• ✗

  The number of open ports on the asset

  Why it's wrong here

  The number of open ports on an asset is not a direct prioritization factor because it only describes the attack surface size, not the exploitability or business impact of any specific vulnerability. A server with three open ports could host a publicly reachable, zero-day-vulnerable service, while a server with fifty open ports might run fully patched, non-sensitive services. Effective prioritization requires analyzing the vulnerability present on a given port and the asset's role, not merely counting the ports.

Go deeper

Related to this question