A retailer tracks two flaws that share one severity label. One is reachable on the card-processing network, and the other sits on a lab PC that stores no payment data. What should change how the team ranks these two findings?
Select an answer to reveal the explanation.
Short Explanation
Two matching price stickers can sit on very different merchandise. You still put the card-network flaw ahead of the empty lab PC, because reachability and impact change the risk. The trap is letting one shared severity label settle the rank.
Full Explanation
Organizational priority follows what can be reached and what would be lost, not a sticker that happens to match. The card-processing flaw sits on a network that touches payment data, while the lab PC stores nothing and is isolated, so the same weakness does not produce the same risk. The ranking that fits is Rank the flaws by impact and exposure rather than by the shared severity label alone. A vulnerability is still only the flaw. Risk is how exposed that flaw is and how bad the outcome would be on that asset. Treat both flaws as equal risk solely from the matching severity labels printed on the ticket misses the distinction, as a label does not record the path to the host or the data sitting on it. Call both flaws exploits even when no code has been used against either flaw yet misses the distinction, as an exploit is code or a method that uses a weakness, and nothing here says either flaw was used. Call both flaws threat actors simply from the shared severity label on the report misses the distinction, as a flaw is not a person or a group and a label does not name an actor. Exam caveat: keep risk, the vulnerability, and the exploit as separate ideas even when a report prints one severity word on both rows. Operational check: note the segment and the data class for each host before you freeze the work order.