A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts.

Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:

It is internet-facing, making it a prime target for attackers.

A compromise could lead to data breaches, downtime, or service disruptions.

Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.

Option A (Development sandbox server) ❌: Internal and not publicly accessible.

Option B (Back-office file transfer server) ❌: Important, but not consumer-facing.

Option C (Perimeter web server) ✅: Correct. Publicly accessible and critical to operations.

Option D (Developer QA server) ❌: May have more vulnerabilities, but it’s less critical.

???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Prioritizing Vulnerability Testing