Vulnerability Remediation Priority: Why Severity Alone Isn't Enough
A vulnerability scan produces these results: - Finding 1: High severity, internet-facing VPN appliance, known exploit available, no compensating controls - Finding 2: Critical severity, internal development workstation, requires authenticated local access - Finding 3: Medium severity, test server, no public exploit and not reachable from outside Which finding should be remediated first?
Quick Answer
The answer is Finding 1, the high-severity, internet-facing VPN appliance with a known exploit and no compensating controls. This is correct because effective vulnerability remediation priority must consider the full risk context beyond severity alone; while Finding 2 has a critical severity score, it requires authenticated local access, meaning an attacker must already be inside the network, whereas Finding 1 combines high severity with an exposed attack surface and an active exploit, creating an immediate remote breach risk. On the Security+ SY0-701 exam, this tests your understanding of risk-based prioritization, often using the CVSS vector or the "attack path" concept to trap candidates who fixate solely on severity numbers. A common memory tip is to think of the "Three E's": Exploit availability, Exposure (internet-facing), and lack of compensating controls—if all three are present, remediate first regardless of the severity label.
⚠ Common exam trap
The trap here is that candidates prioritize by severity alone (Critical > High) without considering the attack vector, exploitability, and network exposure, which are key to risk-based prioritization in the SY0-701 exam.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Finding 1
Finding 1 should be remediated first because it combines high severity with an internet-facing attack surface and a known exploit, meaning an attacker can remotely compromise the VPN appliance without authentication or compensating controls. This creates an immediate and direct risk of network breach, unlike the other findings which require local access or are isolated from external threats.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Finding 1
Why this is correct
Finding 1 carries the highest realistic risk: it is internet-facing, has a known exploit available, and lacks compensating controls, so an attacker can reach and exploit it remotely without credentials. Finding 2 needs authenticated local access, and Finding 3 has no public exploit and no external reachability, lowering urgency.
- ✗
Finding 2
Why it's wrong here
Finding 2 requires authenticated local access on an internal workstation, so exploitation demands existing credentials and internal presence, lowering practical risk despite critical severity. It is tempting because the severity label is highest, but severity alone ignores exposure and exploitability, which Finding 1 combines with an internet-facing asset and available exploit.
- ✗
Finding 3
Why it's wrong here
Finding 3 carries only medium severity, no public exploit and no external reachability, so its risk exposure is lowest. Triage prioritises internet-facing systems with known exploits and no compensating controls. Medium-severity test servers would be remediated first only in a low-risk environment where no high or critical findings exist.
- ✗
All findings are equal because the severity rating alone determines priority
Why it's wrong here
Severity ratings are only one input; exposure, exploit availability and compensating controls determine real risk, so treating all findings as equal misdirects remediation effort. It is tempting because it appears objective and simple, but Finding 1's internet-facing VPN appliance with a known exploit and no compensating controls demands priority.
Go deeper
Related to this question
Learn chapter
Threat Intelligence and Indicators of Compromise
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Attack surface
The attack surface is the total sum of all points in a system, network, or application where an unauthorized user can try to enter or extract data.
About these practice questions
One of 1,030 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A scan returns five findings. Which two should be remediated first based on real-world risk? Select two. A) Internet-facing SSO gateway, CVSS 8.8, public exploit code, and auth bypass impact. B) Internal print server, CVSS 9.8, no known exploit, isolated VLAN, no sensitive data. C) File server with regulated customer records, CVSS 6.5, active exploitation in the wild, reachable from VPN. D) Lab hypervisor, CVSS 7.5, no exploit, scheduled retirement next month, used only by testers. E) Dev wiki, CVSS 5.0, no exploit, no sensitive data.
hard- ✓ A.Internet-facing SSO gateway with public exploit code and authentication-bypass impact.
- B.Internal print server on an isolated VLAN with no known exploit and no sensitive data.
- ✓ C.File server containing regulated customer records, with active exploitation in the wild and VPN reachability.
- D.Lab hypervisor that is scheduled for retirement next month and used only by testers.
- E.Development wiki with low severity, no exploit, and no sensitive data.
Why A: The SSO gateway is internet-facing, has a CVSS 8.8 with public exploit code, and an authentication-bypass impact. This combination means an attacker can gain unauthorized access to all federated applications without credentials, representing a critical risk that must be remediated immediately. The file server contains regulated customer records, is actively exploited in the wild, and is reachable from the VPN, so the combination of sensitive data and active exploitation makes it a top priority despite a lower CVSS score. The other findings have compensating controls (e.g., isolated VLAN, no exploit, no sensitive data) that reduce real-world risk.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.