Vulnerability Prioritization: CVSS vs Exposure Factor

SY0-701 By islever Editorial Last updated

Explain various activities associated with vulnerability management. Explain processes used to manage risk.

Short answer

B Use CVSS severity scores as the primary ranking input for vulnerability prioritization, while treating CVE, exposure factor and industry impact as supporting context.

Question

Which of the following should an organization focus on the most when making decisions about vulnerability prioritization?
  1. Exposure factor
  2. CVSS Correct Answer
  3. CVE
  4. Industry impact

Key Takeaways

The exam is testing whether you can separate vulnerability identification (CVE) from severity scoring (CVSS) and business-loss estimation (exposure factor), with the trap being a business-sounding metric that is not the ranking mechanism.

This SY0-701 question tests vulnerability prioritization, and the defensible choice is CVSS (B) because it supplies a standardized severity score for ranking findings; CVE only identifies, and exposure factor belongs to quantitative risk math.

Common mistake: The most plausible wrong answer is A (exposure factor) because it sounds risk-based and business-specific; however, exposure factor is a quantitative risk component used in SLE/ALE calculations, not a standardized vulnerability prioritization score.

Expert Analysis

The deciding distinction: ranking versus identifying

The stem asks what to focus on most for vulnerability prioritization, not how to name or catalog a flaw. CVSS (B) is the standard severity and ranking system: base metrics for exploitability and impact, plus temporal and environmental metrics. CVE (C) is only a unique identifier; it tells you a vulnerability exists but not how urgently to act. Industry impact (D) is too broad to rank individual findings.

Why exposure factor is the tempting wrong turn

A (exposure factor) is a quantitative risk-analysis input: the percentage of an asset's value expected to be lost if a threat exploits a vulnerability. It belongs in SLE/ALE math and business impact analysis, not in a standardized vulnerability severity ranking. The discussion shows this split: one view calls CVSS the most widely used method for prioritizing vulnerabilities, while another argues exposure determines whether a CVE matters at all. That second view is operationally useful, but it changes the question: if the stem asked which metric estimates business loss from an exploited asset, A would be correct. Here the object being prioritized is the vulnerability, and the options do not include asset value or threat intelligence.

Adjacent decisions and flip conditions

Do not conflate three decisions: identification (CVE), severity scoring and prioritization (CVSS), and quantitative risk (exposure factor/SLE). If the scenario adds that the system is isolated and holds no sensitive data, exposure becomes relevant and a pure CVSS-first answer may be overridden. If it asks which identifier should track the flaw across scanners, choose CVE. If it asks for expected financial loss, choose exposure factor. Modern programs also layer EPSS, CISA KEV, and asset criticality on top of CVSS, but those are not offered here; among these four, B is the primary prioritization input.

Operational consequence

Treating CVE as priority produces an unranked list; treating industry impact as priority ignores the actual system; treating exposure factor as priority without CVSS can under-rank a remotely exploitable, high-severity flaw simply because the asset is not yet classified. CVSS gives a consistent baseline for triage before environmental weighting.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a vulnerability question appears, label the verb first: identify, score, prioritize, or quantify. Identify points to CVE, score or prioritize points to CVSS, and quantify business loss points to exposure factor or SLE. Eliminate answers that are data sources or risk-math components rather than ranking mechanisms. If the stem adds asset criticality or active exploitation, treat CVSS as the baseline and look for the option that incorporates that context.

Frequently Asked Questions

Why is CVSS more relevant than CVE for vulnerability prioritization?

CVE is only a unique identifier for a known vulnerability and carries no severity. CVSS provides a standardized severity score and vector that lets an organization rank findings for remediation.

When would exposure factor be the better focus than CVSS?

When the question asks for business-specific loss or quantitative risk, such as SLE or ALE. Exposure factor estimates the percentage of an asset lost in a successful exploit, not a standardized vulnerability severity score.

Does a high CVSS score always mean a vulnerability should be fixed first?

No. CVSS is the baseline, but asset criticality, internet exposure, active exploitation via KEV or EPSS, and compensating controls can reorder remediation. For this exam question, however, CVSS is the primary prioritization metric among the listed options.

More SY0-701 FAQ →

Discussion 17 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 17

  1. 9ef4a35 👍 8
    B. CVSS (Common Vulnerability Scoring System) The Common Vulnerability Scoring System (CVSS) provides a standardized method to evaluate and score the severity of vulnerabilities. It includes metrics such as exploitability, impact, and environmental factors, which help organizations prioritize vulnerabilities effectively based on their risk level.
  2. Emmyrajj 👍 5 Answered B
    The Common Vulnerability Scoring System (CVSS) provides a standardized way to evaluate and prioritize vulnerabilities based on their severity. CVSS scores consider various factors such as exploitability, impact, and complexity, helping organizations assess the risk level of each vulnerability. By focusing on CVSS scores, an organization can prioritize vulnerabilities that pose the highest risk and allocate resources effectively for remediation.
  3. chasingsummer 👍 5 Answered B
    CVSS provides a numerical score that helps organizations assess which vulnerabilities are most critical and should be prioritized for remediation. This makes it a key factor in vulnerability prioritization decisions.
  4. jbmac 👍 4 Answered B
    The correct answer is: B. CVSS Explanation: CVSS (Common Vulnerability Scoring System) is the most widely used method for prioritizing vulnerabilities. It provides a standardized score (ranging from 0 to 10) that indicates the severity of a vulnerability, helping organizations assess the risk it poses to their systems. The CVSS score takes into account factors such as exploitability, impact on confidentiality, integrity, and availability, making it an essential tool for vulnerability prioritization.
  5. b82faaf 👍 4 Answered B
    Common Vulnerability Scoring System (CVSS) is the best option as this vulnerability 'ranking' system incorporates a broader range of considerations and prioritizations than just the potential percentage of loss the organization would incur if the vulnerability were exploited (i.e. exposure factor).
Show 12 more comments
  1. ProudFather 👍 3 Answered A
    The exposure factor is the potential loss or damage that could occur if a vulnerability is exploited. It takes into account factors like the sensitivity of the data, the potential impact on business operations, and the likelihood of a successful attack. By focusing on the exposure factor, organizations can prioritize vulnerabilities that pose the greatest risk to their business
  2. jacobtriestech 👍 3 Answered A
    While all of the options are important considerations for vulnerability prioritization, the exposure factor is the most critical. It measures the potential impact of a successful exploit, considering factors such as the sensitivity of the data at risk, the number of systems affected, and the potential financial or reputational damage.
  3. Fourgehan 👍 3 Answered A
    Organizations should focus most on Exposure Factor, as it helps prioritize vulnerabilities based on the actual risk they pose to the organization, rather than general severity scores or industry trends
  4. BevMe 👍 3 Answered B
    CVSS is right
  5. VoidDrive 👍 2 Answered A
    Exposure factor is more important. A CVSS of 9 on an isolated lobby kiosk is meaningless.
  6. Dumbledores_Army 👍 1 Answered A
    Which of the following should an organization focus on the most when making decisions about vulnerability prioritization? The organization would focus on their exposure factor. The CVSS will provide a guide scoring the vulnerabilities, and the organization would respond according to their exposure factor and how much each of those vulnerabilities will hurt the organization.
  7. pchuu 👍 1 Answered B
    Why the answer IS NOT Exposure Factor. Exposure factor: This is a risk management metric used in quantitative asset risk calculation (Asset Value × Exposure Factor = Single Loss Expectancy). While it is an important risk indicator, it is not an standalone framework used to assess or prioritize software vulnerabilities
  8. tailogdavid1987 👍 1
    If none of the system are exposed to specific vulnerability, neither CVE or CVSS will be of any meaning. For example, if you have a system that has several CVE's but it is one workstation without any network connection, and very strict physical access controls are in place, then the exposure is low.
  9. tailogdavid1987 👍 1 Answered A
    Prioritize by how exposed this vulnerability is in your environment, not by the generic score alone. CVSS is a useful input if and ONLY if it exists in your environment.
  10. Sam_sgv 👍 1 Answered A
    When prioritizing vulnerabilities, organizations should focus most on the risk to their specific environment, which is represented by the Exposure Factor (EF)
  11. sentinell 👍 1 Answered B
    When making decisions about vulnerability prioritization, an organization should focus most on the threat rating B. CVSS
  12. zron 👍 1 Answered A
    cvss is very general

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide