A vulnerability scanner reports a critical CVE on a server, but the organization's security team determines the vulnerable component is not reachable from any network segment. How should this finding be treated?

Question

Accepted Answer

A. As an accepted risk with compensating control documentation, because network isolation reduces exploitability. When a vulnerable component is network-isolated and not reachable, exploitability is significantly reduced, making it appropriate to treat as an accepted risk with compensating control documentation (network segmentation as the control). The CySA+ exam objectives cover vulnerability prioritization based on exploitability and asset exposure, and vulnerability response including exceptions and compensating controls.

A vulnerability scanner reports a critical CVE on a server, but the organization's security team determines the vulnerable component is not reachable from any network segment. How should this finding be treated?

Related Questions

Discussion