A vulnerability scan of a Linux application server reports these findings: OpenSSL 3.0.7 is flagged with a critical CVE, but the distribution vendor note says the fix was backported. Port 8443 is bound to all interfaces, yet a firewall blocks it from the internet. The internal admin console on that port still uses the default admin/admin credentials and is reachable from the corporate VLAN. Which issue should be remediated first?

Upgrade OpenSSL immediately, because the reported CVE proves the package is exploitable as installed.

The vendor note indicates the fix was backported, so the version number alone may not represent true exposure. That makes this finding less urgent than an actively reachable default credential issue.

Ignore the 8443 service, because the internet firewall already prevents external exposure.

Internal reachability still matters. A service reachable from the corporate VLAN with default credentials is exploitable even if it is blocked from the internet.

Leave the console as-is and focus only on changing the bind address to 127.0.0.1.

Binding locally would reduce exposure, but the question asks for the first remediation step. Active default credentials on a reachable admin interface are more immediately dangerous than interface binding alone.

What does this SY0-701 question test?

Access ports place end devices into a single VLAN.

What is the correct answer to this question?

The correct answer is: Change the default credentials on the internal admin console and restrict access to only approved management hosts. — The first remediation should be removing the default credentials and restricting the admin console to approved management hosts. A reachable management interface with admin/admin is an immediate compromise path, especially on an internal VLAN where attackers may already have footholds. The OpenSSL alert may be a scanner false positive because the distribution backported the patch, so version alone is not the best priority signal here. Why others are wrong: Upgrading OpenSSL may be unnecessary if the vendor already backported the fix, and the scan result may not represent actual exposure. Ignoring the service because it is blocked from the internet overlooks internal attack paths. Changing the bind address helps reduce exposure, but it does not address the most urgent problem: trivial default authentication on a reachable admin console.

What should I do if I get this SY0-701 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.