Vulnerability Prioritization Using Custom Scoring Metrics
A vulnerability management team is unable to patch all vulnerabilities found during their weekly scans. Using the third-party scoring system described below, the team patches the most urgent vulnerabilities:
c
Additionally, the vulnerability management team feels that the metrics Smear and Channing are less important than the others, so these will be lower in priority. Which of the following vulnerabilities should be patched first, given the above third-party scoring system?
Community Insight
The key insight is that not all indicators are equal; the team explicitly de-prioritizes 'Smear' and 'Channing', meaning the correct answer must maximize the presence of the high-priority metrics: Cobain, Grohl, and Novo.
This question tests the ability to prioritize vulnerabilities based on a custom scoring system where specific metrics carry higher weight than others, focusing on risk assessment in vulnerability management.
Candidates often select Option B because it has multiple 'Yes' values, failing to realize that two of those 'Yes' values belong to the low-priority categories (Smear and Channing) which should be ignored or weighted lower.
Community Discussion (14 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option A is the correct choice because it aligns with the prioritization strategy defined by the vulnerability management team. The team considers Cobain, Grohl, and Novo as more important metrics, while Smear and Channing are lower priority. Option A has 'Yes' for all three high-priority metrics (Cobain, Grohl, Novo) and 'No' for the low-priority ones (Smear, Channing), representing the highest relative risk according to the specified criteria.Why the Other Options Are Wrong
Option B includes 'Yes' for Smear and Channing, which are explicitly stated to be less important, diluting its priority despite having high scores in other areas. Option C misses the 'Grohl' metric, making it less critical than A. Option D relies heavily on 'Channing', a low-priority metric, and lacks 'Novo' and 'Grohl', making it the lowest priority among the choices.Community Comment Notes
Many community members were confused by the Nirvana-themed names, with one user noting, "does anyone else here listen to Nirvana? Because whoever wrote this question clearly does." Others criticized the wording, stating, "The questions on this exam so horribly worded." Despite the confusion, many correctly identified that maximizing the high-priority metrics was the key to solving the problem.Exam Strategy
When faced with custom scoring systems in exams, always list the priorities first. Identify which factors are 'high value' and which are 'low value' before looking at the options. Eliminate any option that includes 'Yes' for low-value factors if a better option exists without them.
Frequently Asked Questions
Why is Option B incorrect if it has more 'Yes' answers?
Option B includes 'Yes' for Smear and Channing, which are explicitly lower priority. Since we want to patch the most urgent risks based on the team's preferences, maximizing high-priority metrics is superior.
How do I handle custom metric names in exams?
Treat custom names as placeholders. Map them to their described importance (e.g., 'more important' vs 'less important') rather than guessing their meaning from the name itself.