Which Vulnerability Should Be Remediated First: Web Server RCE?

CA1-005 By islever Editorial Last updated

Given a scenario, analyze vulnerabilities and attacks, and recommend solutions to reduce the attack surface. Given a scenario, perform risk management activities.

Short answer

C Remediate the internet-facing web server remote code execution first, because it offers the highest exposure and full host compromise.

Question

A company must manage the remediation of several vulnerabilities. To do so, a security engineer assesses how software is used in the organization and finds the following:
Exhibit: Which Vulnerability Should Be Remediated First: Web Server RCE?
Which of the following vulnerabilities should the security engineer remediate first?
  1. Buffer overflow
  2. File transfer solution data leakage
  3. Web server remote code execution Correct Answer
  4. CRM privilege escalation

Key Takeaways

The exam tests prioritizing vulnerabilities by exploitability, exposure, and impact; the trap is choosing a technically severe-sounding flaw that is less exposed or requires more preconditions than a public-facing RCE.

This question tests vulnerability remediation prioritization by exposure, exploitability, and business impact. The page establishes that the web server remote code execution flaw should be fixed first because an internet-facing RCE is remotely exploitable and can lead to full host compromise.

Common mistake: A common mistake is selecting buffer overflow or CRM privilege escalation because it sounds technically severe, while overlooking that a publicly reachable web server RCE can be exploited remotely and grants host-level control.

Expert Analysis

Why the Answer Is Correct

Web server remote code execution is the highest-priority remediation because the affected service is typically internet-facing and reachable by unauthenticated attackers. An RCE flaw allows an attacker to execute arbitrary commands at the system level, take control of the host, move laterally, and deploy destructive payloads such as ransomware. The software-usage assessment in the exhibit is a prioritization input, but it does not reduce the severity of a remotely exploitable flaw on an externally exposed service. Given the choices, the combination of high exposure and full host compromise makes the web server RCE the first item to remediate.

Why the Other Options Are Wrong

A buffer overflow can be severe, but its risk depends on the attack vector, whether the vulnerable code is remotely reachable, and whether exploit mitigations are present. The file transfer solution data leakage is primarily a confidentiality breach; serious, but it does not inherently give an attacker command execution or full host control. CRM privilege escalation is also significant, but it generally requires authenticated application access and has a narrower blast radius than an internet-facing RCE. None of these options combines the same level of remote reachability with complete system compromise as the web server RCE.

Community Comment Notes

BWH9492 supports the web server RCE answer, explaining that an RCE flaw lets an unauthenticated attacker run arbitrary system-level commands, take complete control of the host operating system, pivot laterally, and deploy destructive payloads. The comment also emphasizes that a web server is "almost always publicly facing and directly reachable from the internet," making the exposure argument central to prioritization. This aligns with the exam doctrine of remediating the most remotely exploitable, highest-impact vulnerability first when several issues compete for attention.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When remediation resources are limited, rank by internet exposure and exploitability before raw severity alone. Look for an unauthenticated, remotely reachable flaw that can lead to full host compromise, then consider data-confidentiality or authenticated privilege-escalation issues.

Frequently Asked Questions

Why is web server RCE prioritized over CRM privilege escalation?

RCE on an internet-facing host can be exploited remotely without valid CRM credentials and yields OS-level control, while CRM privilege escalation requires application access and has a narrower blast radius.

Does a high-impact data leakage flaw ever outrank RCE?

Only if the data leakage is broadly exposed and the RCE is heavily constrained; by default, externally reachable RCE gets first priority because it enables full host compromise.

More CA1-005 FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. BWH9492 👍 1 Answered C
    An RCE flaw allows an unauthenticated attacker to run arbitrary system-level commands, take complete control of the host operating system, pivot laterally into internal networks, and deploy destructive payloads (like ransomware). A web server is almost always publicly facing and directly reachable from the internet. An externally exposed RCE vulnerability represents an immediate, automated exploit risk requiring the fastest Emergency SLA remediation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Are the Key Design Considerations When Merging OT and Unmanaged IoT?

S-grade

Which two controls best reduce unauthorized BYOD access risk?

S-grade

How to Reduce IaC Deployment Failures in a CI/CD Pipeline?

S-grade

Which Sources Best Support SIEM False Positive and Negative Analysis?

A-grade

← Back to CA1-005 Study Guide