A vulnerability assessment finds that 200 hosts have a critical-severity vulnerability and 50 hosts have a medium-severity vulnerability that is actively exploited in the wild. How should patching be prioritized?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because CVSS scores represent theoretical severity; a vulnerability with active exploitation in the wild (even if medium CVSS) represents a higher immediate threat because attackers are actively using it, requiring immediate action regardless of the lower severity score. A is wrong because CVSS alone without considering exploitability and threat intelligence leads to poor prioritization.
Full explanation below image
Full Explanation
B is correct because CVSS scores represent theoretical severity; a vulnerability with active exploitation in the wild (even if medium CVSS) represents a higher immediate threat because attackers are actively using it, requiring immediate action regardless of the lower severity score. A is wrong because CVSS alone without considering exploitability and threat intelligence leads to poor prioritization. C is wrong because alphabetical ordering has no security relevance. D is wrong because waiting for a combined patch when active exploitation exists exposes the organization unnecessarily.