CySA+ v4 · Objective 2.3

Prioritizing and remediating risk

Build a remediation queue from evidence, exposure, exploitation likelihood, and business consequence. Select workable treatments and verify that the relevant risk actually changed.

What you will be able to do

  • Differentiate true and false findings, including weaknesses missed by an assessment.
  • Interpret CVSS and EPSS as different inputs rather than interchangeable risk scores.
  • Rank findings using exploitation evidence, exposure, asset value, and operational impact.
  • Choose a treatment, manage exceptions, and define evidence-based closure criteria.

Learn the concepts

  1. Lesson 1

    Build a queue that reflects the environment

    Prioritisation is a decision about limited time. A useful queue explains why one weakness deserves attention before another and which evidence could change that order.

    Open lesson →
  2. Lesson 2

    Choose a treatment and prove it worked

    Remediation is complete when evidence supports the intended result. A closed change ticket or a disappearing dashboard item is useful workflow information, but neither independently proves reduced exposure.

    Open lesson →

Apply your judgement · Synthetic scenario

One maintenance window, three competing findings

A fictional booking service has one approved change window this evening. The team must decide the order of work and document what cannot be completed.

Finding A
Public booking gateway; confirmed weakness; credible exploitation reports; supported fix available; customer identity data in scope.
Finding B
Higher CVSS base score than A; unused isolated training image; no permitted path from user networks; owner can retire image tomorrow.
Finding C
Internal scheduling server; confirmed vulnerable component; patch breaks a required integration in testing; limited admin path available.
Previous closure problem
Last week a finding disappeared because scanner credentials expired, not because the package changed.

Your task

  1. Rank the actions and state the business rationale.
  2. Define an interim treatment for the item that cannot yet be patched.
  3. Specify evidence that distinguishes genuine remediation from another assessment failure.
Compare your response

Prioritise A because confirmed exposure, exploitation evidence, and identity-data impact combine with an available fix. Test and deploy through the approved process. Confirm B’s isolation and retirement plan rather than ignoring its score, and track removal of the unused image as an attack-surface reduction action. Review C’s dependency and effective reachability with its owner.

For C, tighten the authorised administrative path, disable unnecessary access, and monitor relevant activity while engineering resolves the integration issue. Document a time-bound exception, a risk owner, the remaining impact, and triggers for urgent escalation. A monitoring rule alone does not replace the absent patch or justify an indefinite delay.

Require successful assessment authentication, evidence of the corrected package or configuration on the intended instances, and a relevant retest. Verify booking and scheduling functions after each approved change. For B, confirm the image is removed from deployment sources as well as running systems; for C, keep the underlying weakness open until its closure criteria are met.

Put it into practice

Use these labs alongside this module.

Check your understanding

Choose the best response to each scenario, then check your reasoning. These are course practice questions.

1. Two confirmed findings compete for one change window. One has a higher CVSS base score on an unused isolated test image; the other affects a public identity service with credible exploitation reports. Which is the best initial decision?
2. A retest shows zero findings immediately after a patch, but every authenticated check failed. What should the analyst report?
3. A vendor has no fix for a confirmed flaw. The team restricts access and adds monitoring. What else is needed?

0 of 3 answered

← Course curriculumNext module: 2.4 →

Source reading: supplied book, chapters 7, 8. Lessons, scenarios, and questions are original CyberCorps course material.