CySA Plus V3 Vulnerability Prioritization Strategy

1. You identify a vulnerability affecting a public-facing web application with active exploit code available. What priority level is appropriate?

Low—wait for vendor guidance

Medium—schedule within normal patch cycle

Critical—remediate immediately or take offline

Defer—monitor for further incidents

Submit

3. A vulnerability is discovered in a firewall with a CVSS score of 6.5 and active in-the-wild exploitation. What action is most appropriate?

Wait for next maintenance window

Prioritize as critical and remediate urgently

Accept risk due to moderate CVSS

Request vendor security advisory first

4. Which element of vulnerability prioritization ensures alignment between security efforts and organizational objectives?

Automated scanning results

Threat modeling and risk assessment

Vendor patch release dates

Compliance audit findings only

5. True or False: Exploit availability is irrelevant when prioritizing vulnerabilities if the CVSS score is high enough.

True

False

Submit

7. A vulnerability requires admin privileges to exploit and affects a user workstation. How does this influence prioritization?

Increases priority due to admin access

Decreases priority due to high privilege requirement

No impact on prioritization

Requires immediate executive approval

8. Which prioritization approach combines technical severity with business context and threat intelligence?

CVSS-only methodology

Holistic risk-based approach

Patch Tuesday schedule

Vendor recommendation only

9. True or False: Vulnerabilities in systems with network access are always higher priority than those in isolated systems.

True

False

Submit

11. When prioritizing vulnerabilities, which factor should you evaluate first to determine business impact?

CVSS base score

Asset criticality and business function

Patch availability

Exploit complexity

12. Which framework aligns vulnerability management with business risk and organizational strategy?

CVSS scoring

Risk-based vulnerability management

Patch management lifecycle

Compliance checklist

Submit

14. True or False: A vulnerability with a low CVSS score should never be prioritized above a high CVSS vulnerability.

True

False

15. A vulnerability exists in a legacy system that cannot be patched. Which mitigation strategy is most appropriate?

Accept the risk indefinitely

Implement network segmentation and monitoring

Immediately decommission the system

Wait for vendor support to resume

16. Which data source provides the most current threat intelligence for zero-day vulnerability prioritization?

Historical vulnerability databases

Active threat feeds and security advisories

Vendor patch schedules

Internal asset inventory

Submit

18. You discover a vulnerability affecting a non-critical development server with a CVSS score of 8.9. What is the best approach?

Immediate patching due to high CVSS

Schedule patching during next maintenance window

Risk acceptance with compensating controls

Escalate to executive management

19. Which CVSS v3.1 metric directly measures the ease with which an attacker can exploit a vulnerability?

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

Scope (S)

20. A vulnerability has a CVSS v3.1 score of 7.5 with a base score of 9.8 but low environmental impact. How should this be prioritized?

Highest priority due to base score

Medium priority based on environmental context

Low priority due to low CVSS

Defer to patch management team

CySA Plus V3 Vulnerability Prioritization Strategy Quiz

1. You identify a vulnerability affecting a public-facing web application with active exploit code available. What priority level is appropriate?

2.

What first name or nickname would you like us to use?

2. The process of ranking vulnerabilities by potential impact before remediation is called ____.

3. A vulnerability is discovered in a firewall with a CVSS score of 6.5 and active in-the-wild exploitation. What action is most appropriate?

4. Which element of vulnerability prioritization ensures alignment between security efforts and organizational objectives?

5. True or False: Exploit availability is irrelevant when prioritizing vulnerabilities if the CVSS score is high enough.

6. When multiple vulnerabilities exist on a single system, the prioritization strategy should focus on those with the highest ____.

7. A vulnerability requires admin privileges to exploit and affects a user workstation. How does this influence prioritization?

8. Which prioritization approach combines technical severity with business context and threat intelligence?

9. True or False: Vulnerabilities in systems with network access are always higher priority than those in isolated systems.

10. The CVSS Environmental Score modifier accounts for ____.

11. When prioritizing vulnerabilities, which factor should you evaluate first to determine business impact?

12. Which framework aligns vulnerability management with business risk and organizational strategy?

13. When exploitability is high and the affected asset is critical, the vulnerability should be prioritized as ____.

14. True or False: A vulnerability with a low CVSS score should never be prioritized above a high CVSS vulnerability.

15. A vulnerability exists in a legacy system that cannot be patched. Which mitigation strategy is most appropriate?

16. Which data source provides the most current threat intelligence for zero-day vulnerability prioritization?

17. Threat modeling helps prioritize vulnerabilities by identifying ____.

18. You discover a vulnerability affecting a non-critical development server with a CVSS score of 8.9. What is the best approach?

19. Which CVSS v3.1 metric directly measures the ease with which an attacker can exploit a vulnerability?

20. A vulnerability has a CVSS v3.1 score of 7.5 with a base score of 9.8 but low environmental impact. How should this be prioritized?