A compliance audit is due in 30 days. A medium-severity vulnerability is found on a noncritical legacy server. The regulation requires remediation of all findings in this category before the audit. Which prioritization approach is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
Think of a compliance date like a train departure: you still need to know if your luggage is already in the right car before sprinting to the platform. You don't ignore the deadline, but you don't treat it as the only risk score either. Patch what the regulation demands, after checking whether compensating controls already lower exposure.
Full Explanation
Prioritization in vulnerability management blends technical severity, asset criticality, exploitability, and mandatory external constraints. A regulatory deadline creates a business requirement to remediate or demonstrate equivalent control, but it does not eliminate the need to assess actual exposure. Validating compensating controls, network segmentation, access paths, and exploitability helps determine whether the required remediation is urgent, scheduled, or already mitigated. Deferring remediation solely because the asset is noncritical or the CVSS score is medium ignores the mandatory timing requirement and can leave a compliance finding open. Treating the deadline as the only priority and patching immediately can cause unnecessary operational disruption and may not address the actual risk if controls already reduce exposure. Accepting the risk because the asset is noncritical or CVSS is medium is inappropriate when a regulation mandates remediation within a defined window; risk acceptance must align with the required control objective, not only technical scoring. Exam caveat: do not assume regulatory deadlines replace vulnerability prioritization; they add a timing constraint that must be reconciled with technical risk. Operational check: review the affected asset exposure, compensating controls, and exploitability, then document the remediation plan with the deadline owner and change window.