SY0-701 Security Operations Practice Question
Exhibit
Prioritized vulnerability review Asset Severity Exposure Notes --------------------------------------------------------------- VPN-EDGE01 Critical Internet-facing Remote code execution; exploit proof-of-concept publicly available FILE-02 High Internal file server SMB service outdated; only reachable from corp subnet TEST-VM-17 High Isolated test network No route from production; development team owns it PRINTER-3F Medium Office user VLAN Default admin credentials; management interface reachable via HTTP
Based on the exhibit, which finding is the best candidate for immediate remediation or emergency mitigation?
⚠ Common exam trap
The trap here is that candidates may prioritize by severity alone (high vs. critical) or by ease of exploitation (default credentials), ignoring the critical factor of network exposure and the presence of public exploit code, which together create the highest immediate risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.
VPN-EDGE01 is an internet-facing device with a critical remote code execution (RCE) vulnerability that has public exploit code available. This combination of high severity, network exposure, and weaponized exploit makes it the highest risk and most urgent for immediate remediation or emergency mitigation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
VPN-EDGE01, because a critical internet-facing RCE with public exploit code has the highest risk.
Why this is correct
VPN-EDGE01 combines severity, exposure, and exploit availability. A critical remote code execution flaw on an internet-facing device is the most urgent because attackers can reach it directly from outside the organization. Public proof-of-concept code further lowers the effort needed to exploit it. When prioritizing vulnerabilities, this combination usually receives immediate remediation or emergency mitigation.
- ✗
FILE-02, because file servers often affect many users and should always come before perimeter systems.
Why it's wrong here
While a file server may be a critical business asset for user data, this finding is internal-only, requiring the attacker to already have a foothold on the internal network. A non-internet-facing server with no direct exposure will always be a lower immediate risk than an internet-facing VPN gateway with a critical remote code execution and public exploit code, because the VPN device can be attacked directly from the internet without any prior access. Availability or user impact does not supersede the urgency of closing an externally reachable RCE.
- ✗
TEST-VM-17, because any high-severity issue deserves the fastest response regardless of exposure.
Why it's wrong here
The CVSS base score for TEST-VM-17 may be high, but severity without context is meaningless. As an isolated test VM, it is not connected to production segmentation, holds no sensitive data, and likely has no route to critical systems, so a compromise would result in minimal blast radius. The lack of an attack path from the internet or even the production environment means the likelihood of real-world exploitation is negligible, making an internet-facing critical RCE with public exploit code far more urgent.
- ✗
PRINTER-3F, because default credentials are the easiest issue to exploit and therefore the most dangerous.
Why it's wrong here
Default credentials are a common and easily exploited misconfiguration, but this printer has a medium severity rating and is confined to the office VLAN, not the internet perimeter. While changing default passwords is a quick win, an attacker on the office VLAN would already have better targets, and printer compromise typically only leads to unauthorized print jobs or firmware tampering rather than access to sensitive systems. In a risk matrix, the combination of high severity, internet exposure, and public exploit code for VPN-EDGE01 dwarfs this local, low-impact printer flaw.
Go deeper
Related to this question
Learn chapter
Patch and Vulnerability Management
Key term
Vulnerability
A vulnerability is a weakness in a system, network, or software that could be exploited by a threat to cause harm or unauthorized access.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
This SY0-701 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SY0-701
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Based on the exhibit, which issue should be remediated first by the operations team? A small company has limited maintenance windows and can address only one of several findings this week.
hard- A.db-lab02, because high-severity findings always outrank medium and critical findings.
- B.printsrv03, because it is internet-facing and has no vendor patch available.
- ✓ C.vpn-gw01, because it is internet-facing, exploitable now, and a fix is available.
- D.None of these, because the team should wait for the next quarterly review before changing anything.
Why C: Vpn-gw01 is internet-facing, has an active exploit (CVSS score indicating current exploitation), and a vendor patch is available. In risk management, the highest priority is given to assets that are exposed to the internet, currently exploitable, and have a known fix, as this combination presents the most urgent threat to the organization's security posture.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.