A metro cloud security review produces dozens of findings on citizen services. How should the team decide what to fix first?
Select an answer to reveal the explanation.
Short Explanation
Not every pothole is the same size on the same road. CVSS plus real exposure—can attackers actually reach it?—tells the city which cracks to fill before rush hour, not alphabetical CVE trivia.
Full Explanation
Assessment prioritizes vulnerabilities by severity and environmental risk, commonly using CVSS alongside exposure context such as internet reachability. Equal treatment of all findings, alphabetical ordering, or deferring critical exposed assets misallocates scarce remediation capacity and prolongs high-risk windows.