The answer is the critical issue on the internet-facing web server with an available exploit. This finding must be remediated first because vulnerability remediation prioritization is driven by risk, which combines severity, exploitability, and asset exposure. A critical severity vulnerability with a known, weaponized exploit on a system exposed to the public internet represents an immediate and remotely exploitable threat, unlike the other options which involve isolated lab VMs, non-domain test workstations, or issues lacking a known exploit. On the Security+ SY0-701 exam, this concept tests your understanding of the risk-based approach to vulnerability management, where the highest-risk combination—not just the highest CVSS score—determines priority. A common trap is focusing solely on severity while ignoring exploitability or exposure; remember that an exploitable critical flaw on an internet-facing asset always trumps a higher severity on an internal or offline system. Use the mnemonic “SEE” for Severity, Exploitability, and Exposure to quickly rank remediation order.
SY0-701 Security Operations Practice Question
This SY0-701 practice question tests your understanding of security operations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?
- A low-severity issue on an offline lab VM
- A medium-severity issue on a payroll server with no known exploit
- A critical issue on an internet-facing web server with an available exploit
- A high-severity issue on a test workstation that is not domain joined
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The critical issue on the internet-facing web server with an available exploit.
The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The low-severity issue on the offline lab VM.
Why it's wrong here
It has the lowest business exposure and the least immediate likelihood of exploitation.
✗
The medium-severity issue on the payroll server with no known exploit.
Why it's wrong here
The asset is important, but the absence of an exploit lowers urgency compared with exposed critical flaws.
✓
The critical issue on the internet-facing web server with an available exploit.
Why this is correct
This combines high severity, public exposure, and active exploitability, making it the highest-priority risk.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
The high-severity issue on the test workstation that is not domain joined.
Why it's wrong here
It is less exposed and less business-critical than the internet-facing production server.
Common exam traps
Common exam trap: answer the scenario, not the keyword
CompTIA often tests the principle that severity alone does not determine priority; candidates must consider exploitability and asset exposure, and the trap here is assuming a high-severity issue on any asset (like a test workstation) should be fixed before a critical issue on an internet-facing server, ignoring that the test workstation is isolated and not domain-joined, reducing its risk profile.
Detailed technical explanation
How to think about this question
Vulnerability scoring systems like CVSS v3.1 calculate risk using metrics such as Attack Vector (AV:N for network), Attack Complexity (AC:L for low), and Exploit Code Maturity (E:P for proof-of-concept). An internet-facing web server with a critical CVSS score (e.g., 9.0-10.0) and an available exploit in frameworks like Metasploit or Exploit-DB means an attacker can execute remote code without authentication, often via buffer overflows or injection flaws (e.g., CVE-2023-44487 for HTTP/2 rapid reset). In contrast, a non-domain-joined test workstation lacks Active Directory trust relationships, limiting lateral movement, and an offline VM has no network stack to target.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Security Operations — This question tests Security Operations — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The critical issue on the internet-facing web server with an available exploit. — The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.
What should I do if I get this SY0-701 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?
easy
A.The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.
✓ B.The critical flaw on the public-facing server, because it has higher business risk.
C.Both systems can wait until the next quarterly patch cycle.
D.The lab system, because internal systems always outrank external systems.
Why B: The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.
Variation 2. A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?
easy
A.Ignore the finding because the server is already protected by a firewall
✓ B.Deploy the patch through the normal change process as soon as possible
C.Mark the vulnerability as accepted risk without notifying the business
D.Remove the web server from the asset inventory to prevent the scanner from finding it
Why B: Option B is correct because the patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.
Variation 3. A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?
medium
A.Install the patch on all servers immediately without testing
✓ B.Use the emergency change process with testing, approval, and a rollback plan
C.Wait until the next quarterly maintenance window to avoid any risk
D.Patch only one production server and assume the rest will be fine
Why B: The correct answer is B because an emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.
Variation 4. A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?
medium
A.Ignore the finding until the next quarterly review because there is no patch available.
B.Move the appliance to a less critical VLAN and leave all access rules unchanged.
✓ C.Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.
D.Disable logging so that attackers cannot learn the appliance version from log data.
Why C: Option C is correct because virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.