A critical CVE on the city's VPN concentrator now has public exploit code circulating. Which mitigation should be prioritized first for that vulnerability?
Select an answer to reveal the explanation.
Short Explanation
When exploit code is already in the wild, patch the hole—yesterday if you can. The VPN box is the priority patient; waiting for a hardware refresh or reimaging laptops does not close that CVE.
Full Explanation
Timely patching (or an approved vendor workaround) of a critical vulnerability on an internet-facing or remote-access appliance—especially when public exploit code exists—is the first-priority mitigation. A city’s VPN concentrator with a critical CVE and circulating exploits is a direct path into municipal networks; delaying invites opportunistic compromise of telework and site-to-site tunnels. Patch windows still need change control, but “promptly” beats annual refresh cycles for exploited criticals.
Ignoring the CVE until the next annual hardware refresh leaves a known, weaponized hole on a high-value gateway for months or years. Replacing all end-user laptops before touching the concentrator misorders priorities: the vulnerable edge device is the shared risk, not every endpoint’s age. Publishing the concentrator admin portal to the internet for faster vendor access expands management exposure and often worsens risk rather than mitigating the CVE.
Exam caveat: when stems cite critical CVEs plus public exploits on VPN or firewall appliances, patching/workaround is the expected first move; compensating controls may accompany but do not replace fixing the device. Do not confuse “risk acceptance” distractors with responsible vulnerability management.
Operational check: apply the vendor patch in a controlled window, validate VPN user and tunnel health, restrict admin interfaces to jump hosts, confirm IDS/SIG coverage for the exploit, and review logs for pre-patch exploitation attempts against the concentrator.