A penetration tester finished a security scan and uncovered numerous vulnerabilities on several hosts. Based on the targets' EPSS and CVSS scores, which of the following targets is the most likely…

Question

Options

• ATarget 1: EPSS Score = 0.6 and CVSS Score = 4
• BTarget 2: EPSS Score = 0.3 and CVSS Score = 2
• CTarget 3: EPSS Score = 0.6 and CVSS Score = 1
• DTarget 4: EPSS Score = 0.4 and CVSS Score = 4.5

• A
  73% (33)
• B
  16% (7)
• C
  4% (2)
• D
  7% (3)

Explanation

Explanation

Option A is correct because Target 1 has the highest EPSS score (0.6) combined with a relatively high CVSS score (4), making it both the most likely to be actively exploited in the wild and significantly severe - the combination of high exploit probability and meaningful severity makes it the greatest real-world attack risk.

The distractors fail because:

• B (0.3 EPSS, 2 CVSS) has the lowest scores in both categories, representing the least likely and least severe threat.
• C (0.6 EPSS, 1 CVSS) ties with A on EPSS probability but has a near-negligible CVSS severity score of 1, meaning even if exploited, the impact is minimal.
• D (0.4 EPSS, 4.5 CVSS) has the highest CVSS score but a significantly lower EPSS (0.4 vs 0.6), meaning it's less likely to actually be exploited despite being theoretically more severe.

Key concept: EPSS (Exploit Prediction Scoring System) measures the probability of exploitation in the wild, while CVSS measures severity/impact - when prioritizing risk, EPSS carries more weight because a highly severe but rarely exploited vulnerability is less urgent than one attackers are actively targeting.

Memory tip: Think "E before C" - Exploitation likelihood (EPSS) before Criticality (CVSS) when determining real-world attack probability.

No community discussion yet for this question.