A penetration tester identifies the following findings during an external vulnerability scan: Which of the following attack strategies should be prioritized from the scan results above?

While obsolete software is a serious risk, it is typically a secondary finding that depends on version disclosure first revealed by server configuration issues, making it lower in prioritization order.

Weak password management is generally identified through credential testing or authentication-focused findings, not directly surfaced by an external configuration-level vulnerability scan.

Weak cryptographic protocols such as TLS 1.0 are a valid concern, but web server misconfiguration revealing sensitive details represents a broader and more immediately actionable attack surface in this context.

Web server misconfiguration findings - such as verbose HTTP response headers revealing software versions, enabled directory listings, or exposed configuration files - provide an attacker with immediately actionable intelligence. These findings are often directly exploitable and also enable more targeted exploitation of other vulnerabilities identified in the scan.