The answer is the critical flaw on an internet-facing VPN appliance with known public exploit code. This is correct because vulnerability remediation priority is driven by risk-based prioritization, which weighs the severity of the vulnerability, the asset’s exposure, and the availability of weaponized code—a critical flaw that is internet-facing and has a public exploit combines the highest possible risk factors, as attackers can immediately compromise the device without advanced skills. On the Security+ SY0-701 exam, this scenario tests your understanding of the risk equation: severity + exposure + exploitability = remediation priority, and a common trap is to fix a high-severity internal flaw first, ignoring the immediate threat of an internet-facing asset with active exploits. Remember the mnemonic “SEE” for Severity, Exposure, Exploitability—when all three are high, patch it first.
SY0-701 Threats, Vulnerabilities, and Mitigations Practice Question
This SY0-701 practice question tests your understanding of threats, vulnerabilities, and mitigations. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. A key principle to apply: vulnerability prioritization considers severity, exposure, and exploitability.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A vulnerability scan finds a critical flaw on an internet-facing VPN appliance and says public exploit code is already available. Which issue should be remediated first?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "first"
Why it matters: Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A critical flaw on an internet-facing VPN appliance with known exploit code
The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.
Key principle: Vulnerability prioritization considers severity, exposure, and exploitability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A low-severity finding on an internal test server with no network access
Why it's wrong here
An isolated low-severity issue is less urgent than a critical flaw exposed to the internet.
✓
A critical flaw on an internet-facing VPN appliance with known exploit code
Why this is correct
This finding is both severe and exposed, which makes exploitation much more likely and business impact potentially high.
Clue confirmation
The clue word "first" in the question point toward this answer.
Related concept
Vulnerability prioritization considers severity, exposure, and exploitability.
✗
A cosmetic configuration warning on a printer management interface
Why it's wrong here
A cosmetic warning is not as urgent as a critical vulnerability on a remote-access device.
✗
A medium-severity issue on a device that is powered off and not in service
Why it's wrong here
A powered-off, unused device presents far less immediate risk than a live internet-facing appliance.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates may prioritize by severity alone without factoring in exploitability, exposure, or asset criticality—leading them to choose a medium or low finding that is technically less urgent but appears more manageable.
Detailed technical explanation
How to think about this question
VPN appliances often terminate IPsec or SSL/TLS tunnels and handle authentication, making them prime targets for remote code execution (RCE) exploits. Public exploit code lowers the barrier to entry, enabling script kiddies and automated scanners to compromise the device. In a real-world scenario, an unpatched VPN appliance with a known CVE (e.g., CVE-2023-46805 in Ivanti Connect Secure) has been used in mass exploitation campaigns, leading to full network compromise.
KKey Concepts to Remember
Vulnerability prioritization considers severity, exposure, and exploitability.
Internet-facing systems have the highest exposure to external threats.
Publicly available exploit code increases the likelihood of attack.
VPN appliances are critical perimeter devices, making their compromise severe.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Vulnerability prioritization considers severity, exposure, and exploitability.
Real-world example
How this comes up in practice
A security team runs a vulnerability scan on a web application and discovers an unpatched SQL injection flaw. The team prioritises remediation by CVSS score — critical flaws are patched within 24 hours, high within 7 days. Questions like this test whether you understand vulnerability management processes, scanning tools, and remediation prioritisation.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this SY0-701 question in full detail.
Review vulnerability prioritization considers severity, exposure, and exploitability., then practise related SY0-701 questions on the same topic to reinforce the concept.
Threats, Vulnerabilities, and Mitigations — This question tests Threats, Vulnerabilities, and Mitigations — Vulnerability prioritization considers severity, exposure, and exploitability..
What is the correct answer to this question?
The correct answer is: A critical flaw on an internet-facing VPN appliance with known exploit code — The critical flaw on an internet-facing VPN appliance with known public exploit code represents the highest risk because it combines a severe vulnerability, direct exposure to the internet, and immediate weaponization potential. VPN appliances are common attack vectors for initial access, and an exploit in the wild means attackers can compromise the device without advanced skills, leading to potential network breach and lateral movement.
What should I do if I get this SY0-701 question wrong?
Review vulnerability prioritization considers severity, exposure, and exploitability., then practise related SY0-701 questions on the same topic to reinforce the concept.
Are there clue words in this question I should notice?
Yes — watch for: "first". Order matters here. You are being tested on which action comes before the others — not which action is generally useful.
What is the key concept behind this question?
Vulnerability prioritization considers severity, exposure, and exploitability.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A scan finds two issues: a critical vulnerability on an internet-facing VPN appliance with public exploit code, and a medium-severity issue on an internal test server. Which should be fixed first?
easy
A.The internal test server issue, because test systems are always higher risk.
✓ B.The VPN appliance issue, because it is critical and publicly exploitable.
C.Both issues at the same time without assigning a priority.
D.Neither issue, because scanners can produce false positives.
Why B: The VPN appliance issue should be fixed first because it is a critical vulnerability on an internet-facing system with publicly available exploit code. This combination means an attacker can directly compromise the appliance from the internet with minimal effort, leading to potential network breach and lateral movement. In contrast, the internal test server is less accessible and poses a lower immediate risk, even though it should still be addressed in due course.
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.