A vulnerability scan rates a flaw on an isolated lab host, which holds no sensitive data, at a CVSS base score of 9.8. The latest penetration test report shows testers chained two medium-severity findings on production servers to gain domain administrator rights. Which should the team remediate FIRST?

Prioritization combines severity assessment with context about exploitability and business impact. A penetration test report provides evidence that is stronger than a theoretical score: the testers demonstrated that two individually moderate weaknesses, combined, give an attacker domain administrator rights on production systems. That outcome represents near-total compromise of the environment, so those findings carry the highest real risk regardless of their individual ratings. Fixing either link in the chain breaks the demonstrated path, which makes them efficient to address first. Choosing the lab host because of its 9.8 base score ignores the environmental context the scenario provides: the host is isolated and holds no sensitive data, so a compromise there has limited impact. Working strictly in descending base-score order repeats the same error at scale, treating a generic severity metric as if it captured asset value and attack paths. Waiting for a scanner to confirm pentest findings misreads the two tools; a pentest report is itself a validated result, and many chained or logic findings never appear in scan output. Exam caveat: base scores are a starting point, and environmental factors legitimately raise or lower urgency. Operational check: map each pentest finding to its affected assets, record the attack path, and verify after remediation that the chain no longer works.