A metro cloud security review produces dozens of findings on citizen services. How should the team decide what to fix first?
Select an answer to reveal the explanation.
Short Explanation
Not every pothole is the same size on the same road. CVSS plus real exposure—can attackers actually reach it?—tells the city which cracks to fill before rush hour, not alphabetical CVE trivia.
Full Explanation
Not every vulnerability finding deserves equal urgency. Metro cloud teams should prioritize using severity and exposure factors—such as CVSS-informed severity and whether the asset is internet-reachable—so critical, exposed issues on citizen services are fixed before low-impact items on isolated systems. Risk-based ordering stretches limited municipal staff time toward what most threatens residents and operations.
Remediating in alphabetical order of CVE ID optimizes fairness theater, not risk. Fixing only informational findings first because they are easiest wastes cycles while real exploit paths remain. Deferring all internet-facing criticals to start with offline lab VMs inverts exposure priority.
Exam caveat: prioritization commonly combines severity, exploitability, asset criticality, and exposure. CVSS is an input, not the only input. Exception handling still needs documentation.
Operational check: tag findings with exposure (internet-facing vs internal) and business service (citizen portal vs lab), sort the queue by agreed policy, publish the top remediations for the week, and report aging criticals to security leadership. Re-prioritize when new KEV/exploit intelligence arrives.