CompTIA CASP+ (CAS-004) — Question 474

A security analyst is reviewing recently released CVEs for software used on servers. Given the following information:

CVE-1: AV:N/PR:L/AC:H/UI:R -

CVE-2: AV:L/PR:H/AC:H/UI:N -

CVE-3: AV:N/PR:L/AC:L/UI:N -

CVE-4: AV:P/PR:H/AC:L/UI:R -

CVE-5: AV:N/PR:H/AC: H/UI:N -

Which of the following CVEs should the security analyst prioritize first?

Answer options

Correct answer: C

Explanation

CVE-3 should be prioritized first because it has an attack vector of 'AV:N', indicating it can be exploited remotely, and a low privilege requirement of 'PR:L'. The other CVEs either require higher privileges or are less critical in terms of exploitability, making them less urgent for the analyst's attention.