CompTIA CySA+ CS0-003 explicitly lists "proprietary systems" as an inhibitor to remediation (i.e., a common obstacle that can delay or block patching/remediation).
Why D (Proprietary systems) is most likely to cause obstacles:
* Proprietary systems often require vendor-provided patches, may have restricted modification, and can create delays due to vendor response time and dependencies on vendor updates. The Secbay Press guide explains that proprietary systems can be challenging due to "restricted access, dependencies on vendor updates, and potential delays in patching."
* The Sybex Study Guide also describes that proprietary systems may not have patches available quickly (or at all), and that vendor support requirements can conflict with vulnerability management needs:
Exact extract (Sybex Study Guide): "Proprietary systems... may not have patches available or may have specific requirements placed on them by vendors... creating a conflict between vulnerability management policies and functional or business requirements." Why the other options are less "most likely" here:
* A (Not meeting an SLA) is typically an outcome (a consequence) rather than the obstacle itself. The inhibitor is the SLA constraints, not "not meeting it." CompTIA objectives list SLA as an inhibitor, not
"not meeting an SLA."
* B (Patch prioritization) is a normal vulnerability management activity, not typically categorized as an inhibitor/obstacle in the CS0-003 inhibitor list.
* C (Organizational governance) is also an inhibitor (bureaucracy/change control can slow remediation), but proprietary systems are often the most "hard-blocking" because you may be unable to patch without vendor action/support. Both are valid inhibitors, but "most likely" in practice (especially in exam framing) commonly points to vendor-controlled/proprietary constraints.
References (CompTIA CySA+ CS0-003 documents / study guides used):
* CompTIA CS0-003 Exam Objectives v4.0: "Inhibitors to remediation" includes proprietary systems
* Secbay Press CS0-003: Proprietary systems create remediation challenges due to vendor dependency and patch delays
* Sybex CS0-003 Study Guide: proprietary systems may restrict patching and vendor support requirements can block remediation

Developing an organization's communication plans is crucial to ensure that incidents, especially those involving sensitive data like PH (Protected Health) data, are promptly reported to the relevant regulatory agencies. This is essential for compliance with legal and regulatory requirements, which often mandate timely notification of data breaches. Effective communication plans help the organization manage the breach response process, mitigate potential legal penalties, and maintain transparency with regulatory bodies.

In this scenario, the security analyst is presented with multiple vulnerabilities, including a critical zero-day vulnerability affecting the web server with a CVSS score of 10. The CVSS (Common Vulnerability Scoring System) provides a standardized method for rating IT vulnerabilities, with a score of 10 indicating the highest severity.
Option A:Contact the web systems administrator and request that they shut down the asset.
* Correct Choice:Given the critical nature of a zero-day vulnerability with a CVSS score of 10, immediate action is warranted to prevent potential exploitation. Shutting down the affected web server reduces the attack surface and mitigates the risk until a patch or workaround is available. This aligns with incident response best practices, where containment is a priority to prevent further damage.
Option B:Monitor the patch releases for all items and escalate patching to the appropriate team.
* Incorrect Choice:While monitoring for patches is essential, it is a reactive approach. In the case of a zero-day vulnerability with active exploitation potential, waiting for a patch without implementing immediate protective measures exposes the organization to significant risk.
Option C:Run the vulnerability scan again to verify the presence of the critical finding and the zero-day vulnerability in the environment.
* Incorrect Choice:Re-scanning may confirm the vulnerability ' s presence but does not address the immediate threat. Action to mitigate the risk should take precedence over verification, especially when the vulnerability is known and critical.
Option D:Forward the advisory to the web security team and initiate the prioritization strategy for the other vulnerabilities.
* Incorrect Choice:Communicating with the web security team is important; however, in the face of a critical zero-day vulnerability, immediate action (such as shutting down the affected asset) is necessary before addressing other vulnerabilities.
Reference:
CompTIA CySA+ CS0-003 Exam Objective 3.2: " Given a scenario, perform incident response activities. " This includes containment strategies to address active threats effectively.

When two vulnerabilities are both high severity (CVSS 8.1 and 8.5) and no compensating controls exist, the deciding factor for remediation prioritization becomes business impact and asset criticality/value (what matters most to the organization if compromised or taken offline for remediation).
That is exactly what a Business Impact Analysis (BIA) is used for: it is a formalized method to determine asset criticality/value designations and to prioritize response/remediation work based on business impact.
Supporting exact extracts:
* The Secbay Press CS0-003 guide explicitly states that Business Impact Analysis is used to align vulnerability prioritization with critical business functions:Exact extract (Secbay Press): "Business Impact Analysis: ... Considers the potential impact of vulnerabilities on critical business functions ...
prioritizing vulnerabilities that could impact core business processes."
* It also describes the vulnerability prioritization process as combining severity/exploitability with asset criticality assessment (which is informed by business owners and BIA outputs):Exact extract (Secbay Press): "Asset Criticality Assessment: Evaluate the criticality of assets affected... Consider the importance of assets in business operations, data sensitivity, and regulatory compliance."
* The All-in-One CS0-003 guide reinforces that asset value (sensitivity + criticality) is one of the most important drivers of remediation timing/prioritization:Exact extract (All-in-One Exam Guide): "Asset value is... one of the most important factors in determining how quickly you should remediate vulnerabilities..." and asset value is tied to "sensitivity and criticality." Applying this to the scenario
* HQFIN01 supports financial transactions for the largest business unit # typically extremely high criticality (availability) and often high sensitivity/integrity requirements.
* HQADMIN02 is used by a privileged user and could be high risk too (admin access), but the question asks what the team would do to determine prioritization: the correct step is to reference BIA/value designation and then prioritize based on which asset is more critical to business operations.
Why the other options are incorrect
* A (Review BCP and patch what takes longer to bring online): BCP/DR planning is not the primary method for vulnerability remediation ranking; prioritization is risk-based and commonly driven by asset criticality/business impact (BIA), not "time to bring online."
* B (Fix the faster one first): Speed of remediation is not the main driver; risk reduction and business impact are.
* D (Least recent backups): Backup recency matters for recovery and resilience, but it's not the primary determinant for vulnerability remediation priority versus asset criticality and business impact.
References (CompTIA CySA+ CS0-003 documents / study guides used):
* Secbay Press, CompTIA CySA+ Exam Prep Guide (CS0-003): BIA used to prioritize vulnerabilities impacting critical business functions; asset criticality assessment in prioritization process
* Mya Heath et al., CompTIA CySA+ All-in-One Exam Guide (CS0-003): asset value (sensitivity + criticality) drives how quickly vulnerabilities should be remediated

The first step should be to perform a public search for malware reports on taskhw.exe, as this file is suspicious for several reasons: it is located in a non-standard path, it has a high CPU usage, it is signed by an unknown entity, and it is only present on one host. A public search can help to determine if this file is a known malware or a legitimate program. If it is malware, the hunter can then take appropriate actions to remove it and prevent further damage. The other options are either premature or ineffective, as they do not provide enough information to assess the threat level of taskhw.exe. References: Cybersecurity Analyst+ - CompTIA, taskhw.
exe Windows process - What is it? - file.net, Taskhostw.exe - What Is Taskhostw.exe & Is It Malware? - MalwareTips Forums