A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output: Hostname | IP address | CVSS 2.0 | EPSS hrdatabase |…

The correct answer is A. fileserver. Given the output, the penetration tester should select the fileserver as the next target for testing, considering both CVSS and EPSS scores. CVSS (Common Vulnerability Scoring System): Purpose: CVSS provides a numerical score to represent the severity of vulnerabilities…

Submitted by daniela_cl· Mar 6, 2026Vulnerability Discovery and Analysis

Question

A penetration tester needs to evaluate the order in which the next systems will be selected for testing. Given the following output:

Hostname | IP address | CVSS 2.0 | EPSS hrdatabase | 192.168.20.55 | 9.9 | 0.50 financesite | 192.168.15.99 | 8.0 | 0.01 legaldatabase | 192.168.10.2 | 8.2 | 0.60 fileserver | 192.168.125.7 | 7.6 | 0.90 Which of the following targets should the tester select next?

Options

Afileserver
Bhrdatabase
Clegaldatabase
Dfinancesite

How the community answered

(28 responses)

A
75% (21)
B
4% (1)
C
14% (4)
D
7% (2)

Explanation

Given the output, the penetration tester should select the fileserver as the next target for testing, considering both CVSS and EPSS scores. CVSS (Common Vulnerability Scoring System): Purpose: CVSS provides a numerical score to represent the severity of vulnerabilities, helping to prioritize remediation efforts. Higher Scores: Indicate more severe vulnerabilities. EPSS (Exploit Prediction Scoring System): Purpose: EPSS estimates the likelihood that a vulnerability will be exploited in the wild within the Higher Scores: Indicate a higher likelihood of exploitation. hrdatabase: CVSS = 9.9, EPSS = 0.50 financesite: CVSS = 8.0, EPSS = 0.01 legaldatabase: CVSS = 8.2, EPSS = 0.60 fileserver: CVSS = 7.6, EPSS = 0.90 The fileserver has the highest EPSS score, indicating a high likelihood of exploitation, despite having a slightly lower CVSS score compared to hrdatabase and legaldatabase.

Topics

#vulnerability prioritization#EPSS#CVSS

Community Discussion

No community discussion yet for this question.

Full PT0-003 Practice