CompTIA PenTest+ (PT0-003)Engagement ManagementHard
During a penetration test, a tester identifies two findings for the final report: a CVE with a CVSS base score of 9.8 on an isolated development server containing no sensitive data, and a misconfiguration on the production authentication server (CVSS 6.5) that allowed the tester to harvest and crack multiple domain administrator NTLM hashes using hashcat. When prioritizing remediation recommendations, which finding should be ranked as the higher priority?
- AThe production authentication misconfiguration, because its business impact and exploitability in context outweigh the base CVSS score
- BWhichever finding was discovered first chronologically
- CThe development server CVE, because CVSS 9.8 always indicates the most urgent risk
- DBoth findings equally, since they were discovered in the same engagement
Show answer & explanationAnswer & explanation
Correct answer: A. The production authentication misconfiguration, because its business impact and exploitability in context outweigh the base CVSS score
Remediation prioritization should consider contextual business risk and impact, not just the base CVSS score. A lower-scored vulnerability that leads to domain admin credential compromise on a production system represents far greater actual risk than a high-CVSS flaw on an isolated, low-value dev server.
Why the other options are wrong
- B. Discovery order has no bearing on actual risk or remediation urgency.
- C. Base CVSS scores don't account for environmental context like asset value or exploitability in the wild.
- D. Equal priority ignores the vastly different business impact of the two findings.
Risk-Based Remediation Prioritization
The practice of prioritizing vulnerability fixes based on actual business impact and exploitability context, not solely on base CVSS scores.
- Considers asset value, data sensitivity, and exploitability
- A lower CVSS score can represent higher real-world risk
- CVSS environmental/temporal metrics can adjust base scores
Memory trick: Context is king — don't just trust the number!