Root Cause Analysis (RCA)is the best approach toidentify and resolve the underlying cause of recurring incidents. It involves a systematic investigation of logs, configurations, and operational data to pinpoint the reason behindpersistent security issues.
* Option A (Vulnerability assessment)helpsidentify security weaknessesbut does not focus on recurring operational issues.
* Option C (Recurrence reports)trackpatternsbut do notresolve the root cause.
* Option D (Lessons learned)is valuable but is typicallya post-mortem discussion rather than an investigative method.
Thus,B is the correct answer, asroot cause analysis is the best approach for diagnosing recurring availability issues.

To determine the correct priority, you must filter the options by applying the rules from Security Policy 1006 in the order of importance dictated by the scenario.
"The Company shall prioritize patching of publicly available systems and services over patching of internally available system."
* Option A: Internal System
* Option B: External System (Keep)
* Option C: External System (Keep)
* Option D: Internal System
Result: Eliminate Options A and D. We are now choosing between B and C.
"In situations where a choice must be made between confidentiality and availability, the Company shall prioritize confidentiality of data over availability of systems and data." To apply this, you must read the CVSS v3.1 Vector String for the remaining options. The relevant metrics are C (Confidentiality) and A (Availability).
* Option B (CAP.SHIELD): C:H / I:N / A:N
* Confidentiality: High (C:H)
* Availability: None (A:N)
* Interpretation: This vulnerability allows for a significant breach of data confidentiality.
* Option C (LOKI.DAGGER): C:N / I:N / A:H
* Confidentiality: None (C:N)
* Availability: High (A:H)
* Interpretation: This vulnerability allows for a significant disruption of service (DoS).
Conclusion: Since the policy explicitly prioritizes Confidentiality (Option B) over Availability (Option C), Option B is the highest priority.
The exam expects you to parse raw CVSS strings to assess risk. Here is the breakdown for the correct answer (Option B):
Metric
Code
Value
Meaning
AV
AV:N
Network
The vulnerability is exploitable remotely via the network (most dangerous).
AC
AC:L
Low
No complex conditions are required to exploit.
PR
PR:N
None
No privileges are required (unauthenticated).
UI
UI:N
None
No user interaction is required.
C
C:H
High
Confidentiality Impact. Total loss of confidentiality.
A
A:N
None
Availability Impact. No impact to uptime.

* SOAR (Security Orchestration, Automation, and Response) platforms help automate and orchestrate incident response tasks, including phishing triage.
* SOAR reduces triage time by automatically:
* Parsing phishing emails (checking headers, links, attachments).
* Running automated playbooks to check for known malicious indicators.
* Escalating real threats while dismissing false positives.
Why Not Other Options?
* B (Increase security awareness) # Helps prevent phishing but does NOT reduce triage time.
* C (Implement EDR) # EDR is useful for endpoint protection but does NOT specifically reduce phishing triage time.
* D (Install a "Report Phishing" button) # Helps report phishing but does NOT automate the triage process.
Reference: CompTIA CySA+ CS0-003, Chapter 7: "Security Operations and Automation," Section: "SOAR and Incident Response Efficiency"

Weaponization is the stage of the Cyber Kill Chain where the threat actor creates or modifies a malicious tool to use against a target. In this case, the threat actor compiles and tests a malicious downloader, which is a type of weaponized malware. References: Cybersecurity 101, The Cyber Kill Chain: The Seven Steps of a Cyberattack

Vulnerability 2 has the highest impact metrics, specifically the highest attack vector (AV) and attack complexity (AC) values. This means that the vulnerability is more likely to be exploited and more difficult to remediate.
References:
CVSS v3.1 Specification Document, section 2.1.1 and 2.1.2
The CVSS v3 Vulnerability Scoring System, section 3.1 and 3.2