Exam CS0-002 topic 1 question 413 discussion

Actual exam question from CompTIA's CS0-002

Question #: 413
Topic #: 1

An analyst needs to provide recommendations based on the following vulnerability report:

Which of the following vulnerabilities should the analyst recommend addressing first?

A. SSL certificate signed using weak hashing algorithm
B. TLS version 1.0 protocol detection
C. PHP 7.1.x <7.1.25 multiple vulnerabilities
D. RHEL 7 : qemu-kvm (RHSA-2020:1208)

Show Suggested Answer

Suggested Answer: C 🗳️

by Saphi at Sept. 27, 2023, 5:49 p.m.

Comments

Submit Cancel

dickchappy

1 year, 7 months ago

Selected Answer: B

There is NO exploit available for the critical vulnerability. High severity with an available exploit should take priority.

upvoted 2 times

dickchappy

1 year, 7 months ago

Meant to select C

upvoted 1 times

...

ElDirec

1 year, 8 months ago

Selected Answer: D

Critical is Critical, according to the training. So it goes first

upvoted 1 times

fgfj

1 year, 7 months ago

There is no exploit available for the critical vulnerability. High vulnerability with exploit available > Critical vulnerability with no exploit available.

upvoted 1 times

...

JakeH

1 year, 9 months ago

I would agree, the critical doesn’t always take the highest priority in every situation. Given the question and these details only, C is the answer.

upvoted 1 times

...

Nobody's commented here I assume because noone knows the exact answer. I'd guess a high exploitable vulnerability taking precedent over a critical vulnerability with no exploit but that's just my two cents. If anyone works out the answer let me know!

upvoted 4 times

...