How to Prioritize Vulnerability Remediation: Severity, Exploitability & Asset Exposure
A vulnerability dashboard shows four new findings. Which one should be remediated first by the operations team?
- A low-severity issue on an offline lab VM - A medium-severity issue on a payroll server with no known exploit - A critical issue on an internet-facing web server with an available exploit - A high-severity issue on a test workstation that is not domain joined
Quick Answer
The answer is the critical issue on the internet-facing web server with an available exploit. This finding must be remediated first because vulnerability remediation prioritization is driven by risk, which combines severity, exploitability, and asset exposure. A critical severity vulnerability with a known, weaponized exploit on a system exposed to the public internet represents an immediate and remotely exploitable threat, unlike the other options which involve isolated lab VMs, non-domain test workstations, or issues lacking a known exploit. On the Security+ SY0-701 exam, this concept tests your understanding of the risk-based approach to vulnerability management, where the highest-risk combination—not just the highest CVSS score—determines priority. A common trap is focusing solely on severity while ignoring exploitability or exposure; remember that an exploitable critical flaw on an internet-facing asset always trumps a higher severity on an internal or offline system. Use the mnemonic “SEE” for Severity, Exploitability, and Exposure to quickly rank remediation order.
⚠ Common exam trap
CompTIA often tests the principle that severity alone does not determine priority; candidates must consider exploitability and asset exposure, and the trap here is assuming a high-severity issue on any asset (like a test workstation) should be fixed before a critical issue on an internet-facing server, ignoring that the test workstation is isolated and not domain-joined, reducing its risk profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The critical issue on the internet-facing web server with an available exploit.
The critical issue on the internet-facing web server with an available exploit should be remediated first because it combines the highest severity (critical) with an active, exploitable vulnerability on an asset exposed to the public internet. In vulnerability management, remediation priority is determined by risk, which is a function of severity, exploitability, and asset exposure. An internet-facing web server with a known exploit represents an immediate threat that can be remotely compromised, unlike the other findings which are on isolated or less critical systems.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The low-severity issue on the offline lab VM.
Why it's wrong here
It has the lowest business exposure and the least immediate likelihood of exploitation.
- ✗
The medium-severity issue on the payroll server with no known exploit.
Why it's wrong here
The asset is important, but the absence of an exploit lowers urgency compared with exposed critical flaws.
- ✓
The critical issue on the internet-facing web server with an available exploit.
Why this is correct
This combines high severity, public exposure, and active exploitability, making it the highest-priority risk.
- ✗
The high-severity issue on the test workstation that is not domain joined.
Why it's wrong here
It is less exposed and less business-critical than the internet-facing production server.
Go deeper
Related to this question
Learn chapter
Identity and Access Management
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Vulnerability management
Vulnerability management is the continuous process of identifying, classifying, prioritizing, and remediating security weaknesses in an organization's IT environment.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A vulnerability scan finds a critical flaw on a public-facing server and a medium flaw on a lab system that is not connected to the production network. Which issue should be fixed first?
easy- A.The medium flaw on the isolated lab system, because all vulnerabilities should be fixed in alphabetical order.
- ✓ B.The critical flaw on the public-facing server, because it has higher business risk.
- C.Both systems can wait until the next quarterly patch cycle.
- D.The lab system, because internal systems always outrank external systems.
Why B: The critical flaw on the public-facing server should be fixed first because it presents a higher business risk. A public-facing server is directly accessible from the internet, making it a prime target for attackers. Exploiting a critical vulnerability could lead to data breaches, service disruption, or unauthorized access, with immediate and severe business impact. In contrast, the medium flaw on an isolated lab system poses no direct threat to production operations or sensitive data.
Variation 2. A security scan finds a critical patch missing on a public-facing web server. The patch has already been tested in the lab and approved for deployment. What should the operations team do next?
easy- A.Ignore the finding because the server is already protected by a firewall
- ✓ B.Deploy the patch through the normal change process as soon as possible
- C.Mark the vulnerability as accepted risk without notifying the business
- D.Remove the web server from the asset inventory to prevent the scanner from finding it
Why B: The patch has already been tested and approved, meaning it is ready for deployment. The operations team should follow the normal change management process to deploy the patch as soon as possible, ensuring the public-facing web server is secured against the critical vulnerability without bypassing organizational controls.
Variation 3. A vulnerability scan identifies a critical patch for a fleet of internet-facing servers. The operations lead wants to apply it immediately during peak business hours because the exploit is public. What is the BEST next step?
medium- A.Install the patch on all servers immediately without testing
- ✓ B.Use the emergency change process with testing, approval, and a rollback plan
- C.Wait until the next quarterly maintenance window to avoid any risk
- D.Patch only one production server and assume the rest will be fine
Why B: An emergency change process allows the critical patch to be applied quickly while still incorporating essential steps like testing, approval, and a rollback plan. This balances the urgency of a public exploit with the need to avoid unintended service disruptions during peak business hours, aligning with change management best practices in Security Operations.
Variation 4. A monthly vulnerability scan identifies a critical vulnerability on a public-facing VPN appliance, but the vendor says no patch is available yet. The service must remain online for remote workers. What is the best compensating control to reduce risk right away?
medium- A.Ignore the finding until the next quarterly review because there is no patch available.
- B.Move the appliance to a less critical VLAN and leave all access rules unchanged.
- ✓ C.Apply virtual patching or traffic filtering to block exploit attempts until remediation is possible.
- D.Disable logging so that attackers cannot learn the appliance version from log data.
Why C: Virtual patching or traffic filtering (e.g., via an IPS or WAF) provides immediate, compensating protection by inspecting and blocking exploit traffic targeting the vulnerability, without requiring the vendor to release a patch. This allows the VPN appliance to remain online for remote workers while reducing the risk of exploitation until a permanent fix is available.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.