In this scenario, the security analyst is presented with multiple vulnerabilities, including a critical zero-day vulnerability affecting the web server with a CVSS score of 10. The CVSS (Common Vulnerability Scoring System) provides a standardized method for rating IT vulnerabilities, with a score of 10 indicating the highest severity.
Option A:Contact the web systems administrator and request that they shut down the asset.
* Correct Choice:Given the critical nature of a zero-day vulnerability with a CVSS score of 10, immediate action is warranted to prevent potential exploitation. Shutting down the affected web server reduces the attack surface and mitigates the risk until a patch or workaround is available. This aligns with incident response best practices, where containment is a priority to prevent further damage.
Option B:Monitor the patch releases for all items and escalate patching to the appropriate team.
* Incorrect Choice:While monitoring for patches is essential, it is a reactive approach. In the case of a zero-day vulnerability with active exploitation potential, waiting for a patch without implementing immediate protective measures exposes the organization to significant risk.
Option C:Run the vulnerability scan again to verify the presence of the critical finding and the zero-day vulnerability in the environment.
* Incorrect Choice:Re-scanning may confirm the vulnerability ' s presence but does not address the immediate threat. Action to mitigate the risk should take precedence over verification, especially when the vulnerability is known and critical.
Option D:Forward the advisory to the web security team and initiate the prioritization strategy for the other vulnerabilities.
* Incorrect Choice:Communicating with the web security team is important; however, in the face of a critical zero-day vulnerability, immediate action (such as shutting down the affected asset) is necessary before addressing other vulnerabilities.
Reference:
CompTIA CySA+ CS0-003 Exam Objective 3.2: " Given a scenario, perform incident response activities. " This includes containment strategies to address active threats effectively.