Zero Trust Network Access (ZTNA)simplifies secure remote access to cloud and SaaS applications by enforcing identity-based, least-privilege access policies. It eliminates the need to extend traditional network- based access models to the cloud. ZTNA ensures thateach user is verified continuouslyregardless of their network location, aligning perfectly with complex multi-cloud or SaaS environments.
* RADIUS (A)is an older authentication protocol, not ideal for SaaS cloud scale.
* SDN (B)controls network flow, not identity management.
* SWG (D)is a secure web proxy, not for access control and IAM extension.
#Reference:
* CS0-003 Exam Objectives 1.1 - Identity and Access Management
* Sybex Study Guide - Chapple & Seidl, Chapter 2: Zero Trust & Cloud IAM

The best way to ensure that the investigation complies with HR or privacy policies is to ensure that the case details do not reflect any user-identifiable information, such as name, email address, phone number, or employee ID. This can help protect the privacy and confidentiality of the user and prevent any potential discrimination or retaliation. Additionally, password protecting the evidence and restricting access to personnel related to the investigation can help preserve the integrity and security of the evidence and prevent any unauthorized or accidental disclosure or modification.

To determine the correct priority, you must filter the options by applying the rules from Security Policy 1006 in the order of importance dictated by the scenario.
"The Company shall prioritize patching of publicly available systems and services over patching of internally available system."
* Option A: Internal System
* Option B: External System (Keep)
* Option C: External System (Keep)
* Option D: Internal System
Result: Eliminate Options A and D. We are now choosing between B and C.
"In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data." To apply this, you must read the CVSS v3.1 Vector String for the remaining options. The relevant metrics are C (Confidentiality) and A (Availability).
* Option B (CAP.SHIELD): C:H / I:N / A:N
* Confidentiality: High (C:H)
* Availability: None (A:N)
* Interpretation: This vulnerability allows for a significant breach of data confidentiality.
* Option C (LOKI.DAGGER): C:N / I:N / A:H
* Confidentiality: None (C:N)
* Availability: High (A:H)
* Interpretation: This vulnerability allows for a significant disruption of service (DoS).
Conclusion: Since the policy explicitly prioritizes Confidentiality (Option B) over Availability (Option C), Option B is the highest priority.
The exam expects you to parse raw CVSS strings to assess risk. Here is the breakdown for the correct answer (Option B):
Metric
Code
Value
Meaning
AV
AV:N
Network
The vulnerability is exploitable remotely via the network (most dangerous).
AC
AC:L
Low
No complex conditions are required to exploit.
PR
PR:N
None
No privileges are required (unauthenticated).
UI
UI:N
None
No user interaction is required.
C
C:H
High
Confidentiality Impact. Total loss of confidentiality.
A
A:N
None
Availability Impact. No impact to uptime.

CVSS 3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H is the attack vector that the analyst should remediate first, as it has the highest CVSSv3 score of 8.1. CVSSv3 (Common Vulnerability Scoring System version 3) is a standard framework for rating the severity of vulnerabilities, based on various metrics that reflect the characteristics and impact of the vulnerability. The CVSSv3 score is calculated from three groups of metrics:
Base, Temporal, and Environmental. The Base metrics are mandatory and reflect the intrinsic qualities of the vulnerability, such as how it can be exploited, what privileges are required, and what impact it has on confidentiality, integrity, and availability. The Temporal metrics are optional and reflect the current state of the vulnerability, such as whether there is a known exploit, a patch, or a workaround. The Environmental metrics are also optional and reflect the context of the vulnerability in a specific environment, such as how it affects the asset value, security requirements, or mitigating controls. The Base metrics produce a score ranging from 0 to 10, which can then be modified by scoring the Temporal and Environmental metrics. A CVSS score is also represented as a vector string, a compressed textual representation of the values used to derive the score.
The attack vector in question has the following Base metrics:
Attack Vector (AV): Network (N). This means that the vulnerability can be exploited remotely over a network connection.
Attack Complexity (AC): Low (L). This means that the attack does not require any special conditions or changes to the configuration of the target system.
Privileges Required (PR): Low (L). This means that the attacker needs some privileges on the target system to exploit the vulnerability, such as user-level access.
User Interaction (UI): None (N). This means that the attack does not require any user action or involvement to succeed.
Scope (S): Unchanged (U). This means that the impact of the vulnerability is confined to the same security authority as the vulnerable component, such as an application or an operating system.
Confidentiality Impact : High (H). This means that the vulnerability results in a total loss of confidentiality, such as unauthorized disclosure of all data on the system.
Integrity Impact (I): High (H). This means that the vulnerability results in a total loss of integrity, such as unauthorized modification or deletion of all data on the system.
Availability Impact (A): High (H). This means that the vulnerability results in a total loss of availability, such as denial of service or system crash.
Using these metrics, we can calculate the Base score using this formula:
Base Score = Roundup(Minimum[(Impact + Exploitability), 10])
Where:
Impact = 6.42 x [1 - ((1 - Confidentiality) x (1 - Integrity) x (1 - Availability))] Exploitability = 8.22 x Attack Vector x Attack Complexity x Privileges Required x User Interaction Using this formula, we get:
Impact = 6.42 x [1 - ((1 - 0.56) x (1 - 0.56) x (1 - 0.56))] = 5.9
Exploitability = 8.22 x 0.85 x 0.77 x 0.62 x 0.85 = 2.8
Base Score = Roundup(Minimum[(5.9 + 2.8), 10]) = Roundup(8.7) = 8.8
Therefore, this attack vector has a Base score of 8.8, which is higher than any other option.
The other attack vectors have lower Base scores, as they have different values for some of the Base metrics:
CVSS:3.0/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 6.2, as it has a lower value for Attack Vector (Physical), which means that the vulnerability can only be exploited by having physical access to the target system.
CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 7.4, as it has a lower value for Attack Vector (Adjacent Network), which means that the vulnerability can only be exploited by being on the same physical or logical network as the target system.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H has a Base score of 6.8, as it has a lower value for Attack Vector (Local), which means that the vulnerability can only be exploited by having local access to the target system, such as through a terminal or a command shell.

Business process interruption is the inhibitor to remediation that this scenario illustrates. Business process interruption is when the remediation of a vulnerability or an incident requires the disruption or suspension of a critical or essential business process, such as the point-of-sale application. This can cause operational, financial, or reputational losses for the organization, and may outweigh the benefits of the remediation.
Therefore, the organization may decide to postpone or avoid the remediation until a more convenient time, such as a change freeze window, which is a period of time when no changes are allowed to the IT environment12. Service-level agreement, degrading functionality, and proprietary system are other possible inhibitors to remediation, but they are not relevant to this scenario. Service-level agreement is when the remediation of a vulnerability or an incident violates or affects the contractual obligations or expectations of the service provider or the customer. Degrading functionality is when the remediation of a vulnerability or an incident reduces or impairs the performance or usability of a system or an application. Proprietary system is when the remediation of a vulnerability or an incident involves a system or an application that is owned or controlled by a third party, and the organization has limited or no access or authority to modify it3.
References: Inhibitors to Remediation - SOC Ops Simplified, Remediation Inhibitors - CompTIA CySA+, Information security Vulnerability Management Report (Remediation...