Vulnerability scan summary: 1) Internet-facing VPN appliance CVSS: 8.8 Exploit status: public proof-of-concept available Exposure: reachable from the internet Compensating controls: none 2) Internal HR file server CVSS: 9.8 Exploit status: no public exploit yet Exposure: reachable only from the employee VLAN Compensating controls: segmented network and MFA for admin access 3) Lab workstation CVSS: 10.0 Exploit status: public exploit available Exposure: isolated lab VLAN with no routing to production 4) DMZ reporting server CVSS: 7.5 Exploit status: public exploit available Exposure: internet-reachable, but protected by WAF and IP allowlisting
Based on the exhibit, which issue should be remediated FIRST?
The team can only fully fix one issue today. Management wants the choice that best reduces real-world risk, not just the highest severity score.
Answer choices
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
Internet-facing VPN appliance
This asset is externally reachable, has a known public exploit, and lacks compensating controls. That combination creates the highest immediate likelihood of compromise.
Internal HR file server
The score is high, but the server is not directly internet-exposed and has layered controls that reduce immediate attack likelihood.
Lab workstation
Although severe, the lab is isolated from production, so the business impact and likelihood are much lower than an exposed perimeter device.
DMZ reporting server
The server is exposed, but the WAF and allowlist reduce practical exploitability compared with the VPN appliance that has no compensating controls.
Common exam trap
Many certification questions include familiar terms but test a specific constraint. Read the exact wording before choosing an answer that is generally true but wrong for this case.
Technical deep dive
This question should be treated as a scenario, not a definition check. Identify the problem, the constraint and the best action. Then compare each option against those facts.
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise SY0-701 questions linked to Security+ social engineering questions.
Practise SY0-701 questions linked to Security+ cryptography.
Practise SY0-701 questions linked to Security+ IAM questions.
Practise SY0-701 questions linked to Security+ risk management questions.
Practise SY0-701 questions linked to Security+ incident response questions.
Practise SY0-701 questions linked to Security+ malware questions.
Practise SY0-701 questions linked to Security+ vulnerability management questions.
Practise SY0-701 questions linked to Security+ security operations questions.
Practise SY0-701 questions linked to Security+ zero trust questions.
Practise SY0-701 questions linked to Security+ authentication factors questions.
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
Question 2
Question 3
Question 4
Question 5
Question 6
FAQ
Read the scenario before looking for a memorised answer.
The correct answer is: Internet-facing VPN appliance — The VPN appliance should be fixed first because risk is driven by both likelihood and impact, not CVSS alone. It is internet-facing, has a public exploit, and lacks compensating controls, so exploitation is highly likely and would affect remote access to the environment. The internal HR server has a higher score but much lower exposure. The lab workstation is isolated, and the DMZ reporting server has at least some protective controls already in place. Why others are wrong: A higher CVSS score does not automatically mean a higher remediation priority if exposure is limited. The internal HR server is harder to reach and protected by segmentation and MFA for administrators. The lab workstation is isolated from production, so compromise is less likely to matter operationally. The DMZ reporting server is exposed, but the WAF and allowlist materially lower attack likelihood relative to the unprotected VPN appliance.
Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.
Sign in to join the discussion.