A vulnerability assessment finds that 200 hosts have a critical-severity vulnerability and 50 hosts have a medium-severity vulnerability that is actively exploited in the wild. How should patching be prioritized?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you patch the 50 medium-severity hosts with active exploitation first because attackers are already using that flaw, so it's the higher immediate risk. Then you handle the 200 critical-severity hosts.
Full Explanation
The correct approach is to patch the 50 medium-severity hosts with active exploitation first because CVSS scores represent theoretical severity, while a vulnerability with active exploitation in the wild represents a higher immediate threat because attackers are actively using it, requiring immediate action regardless of the lower severity score; then address the 200 critical-severity hosts. The option to patch all 200 critical-severity hosts first is wrong because CVSS alone, without considering exploitability and threat intelligence, leads to poor prioritization. The option to patch by alphabetical hostname order is wrong because alphabetical ordering has no security relevance. The option to wait for the vendor to release a combined patch for both vulnerabilities is wrong because waiting for a combined patch when active exploitation exists exposes the organization unnecessarily.