PT0-003: CompTIA PenTest+Demo

By CompTIA · Question Mode

QuestionQ163

Vulnerability Discovery and Analysis

A penetration tester has completed a security scan and identified numerous vulnerabilities across several hosts. Based on the targets’ EPSS and CVSS scores, which of the following targets is most likely to be attacked?

  • A Target 1: EPSS Score = 0.6 and CVSS Score = 4
  • B Target 2: EPSS Score = 0.3 and CVSS Score = 2
  • C Target 3: EPSS Score = 0.6 and CVSS Score = 1
  • D Target 4: EPSS Score = 0.4 and CVSS Score = 4.5
Explanation

EPSS (Exploit Prediction Scoring System) measures the probability of real-world exploitation on a 0–1 scale, while CVSS measures vulnerability severity. When prioritizing targets for likelihood of attack, EPSS is the primary metric; among targets with identical EPSS scores, higher CVSS indicates greater impact. Target 1 has the highest EPSS (0.6) and a moderate CVSS (4), making it the most probable exploitation target.

Community Discussion

No comments yet. Be the first to start the discussion!