nerdexam
CompTIA

SY0-501 · Question #381

A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated…

The correct answer is B. Apply organizational context to the risk rating. Upon discovering a critical vulnerability from an internal scan, the security analyst's first action should be to apply organizational context to the risk rating before initiating other responses.

Submitted by sofia.br· Mar 4, 2026Security operations

Question

A security analyst is inspecting the results of a recent internal vulnerability scan that was performed against intranet services. The scan reports include the following critical-rated vulnerability:

Title: Remote Command Execution vulnerability in web server Rating: Critical (CVSS 10.0) Threat actor: any remote user of the web server Confidence: certain Recommendation: apply vendor patches Which of the following actions should the security analyst perform FIRST?

Options

  • AEscalate the issue to senior management.
  • BApply organizational context to the risk rating.
  • COrganize for urgent out-of-cycle patching.
  • DExploit the server to check whether it is a false positive.

How the community answered

(33 responses)
  • A
    18% (6)
  • B
    70% (23)
  • C
    3% (1)
  • D
    9% (3)

Why each option

Upon discovering a critical vulnerability from an internal scan, the security analyst's first action should be to apply organizational context to the risk rating before initiating other responses.

AEscalate the issue to senior management.

Escalating the issue to senior management immediately, without first understanding the specific organizational impact and context, is premature and could cause undue alarm or be misinformed.

BApply organizational context to the risk rating.Correct

Applying organizational context is the crucial first step as it involves assessing the specific impact of the vulnerability within the organization's environment, considering factors like asset criticality, data sensitivity, and actual exposure (e.g., intranet vs. internet-facing). This contextualization allows for a more accurate risk assessment and prioritizes remediation efforts effectively, ensuring resources are allocated based on actual business risk rather than just a generic CVSS score.

COrganize for urgent out-of-cycle patching.

Organizing for urgent out-of-cycle patching without first understanding the specific organizational impact, risk, and priority could lead to misallocated resources or unnecessary disruption.

DExploit the server to check whether it is a false positive.

Exploiting a production server to verify a vulnerability is a highly risky action that could cause service disruption or data loss, and should only be performed in controlled environments and with proper authorization.

Concept tested: Vulnerability management risk contextualization and prioritization

Source: https://learn.microsoft.com/en-us/training/modules/develop-vulnerability-management-strategy/4-assess-risk

Topics

#vulnerability management#CVSS#risk context#patch prioritization

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SY0-501 Practice