SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The internal test server issue, because test systems are always higher risk.

  Why it's wrong here

  The internal test server issue is not automatically the highest risk because test systems typically reside on an internal network segment, limiting exposure to the public internet. The critical VPN appliance flaw, in contrast, is directly reachable from the internet and has known exploit code, making an actual breach far more imminent. In risk-based prioritization, asset exposure and exploitability outweigh the type or role of the system.

• ✓

  The VPN appliance issue, because it is critical and publicly exploitable.

  Why this is correct

  The VPN appliance issue should be addressed first because it combines a critical severity rating with direct internet exposure and publicly available exploit code, creating an immediate and realistic attack vector. This scenario represents a high likelihood of compromise with high impact, often allowing full network access. Prioritizing this issue aligns with common frameworks like the CVSS base score and EPSS, where exploitability and network reachability significantly elevate remediation urgency.

• ✗

  Both issues at the same time without assigning a priority.

  Why it's wrong here

  Addressing both issues simultaneously with no priority is inefficient and dangerous because security resources are finite and response teams must focus on minimizing the greatest risk first. The two vulnerabilities likely differ in severity, exploitability, and blast radius, making a risk-based triage essential. Treating them equally could delay remediation of the critical external VPN flaw, leaving an exploitable entry point open while internal test server issues carry far less immediate threat.

• ✗

  Neither issue, because scanners can produce false positives.

  Why it's wrong here

  Ignoring both findings due to potential false positives is negligent because the critical VPN vulnerability is internet-facing and has exploit code, which dramatically increases the chance it is real and actively targeted. While scanner false positives do occur, the correct action is to validate the finding, not dismiss it outright. By the time manual confirmation is performed, an attacker could already leverage the flaw; therefore, urgent verification and mitigation are required.