A company performs a vulnerability assessment and gets the following results:Vulnerability | Server location |...

Vulnerability 1 should be patched first because it has both the highest severity and the highest exposure. A CVSS score of 9.8 indicates a critical vulnerability, and the affected server is internet-facing. Internet-facing systems are directly exposed to external threat actors, automated scanning, exploit kits, and opportunistic attacks. Vulnerability 4 also has a CVSS score of 9.8, but it is internal, so the exposure is lower unless an attacker already has access inside the environment. Vulnerabilities 2 and 3 have lower CVSS scores and therefore lower technical severity. Security+ prioritization considers severity, asset exposure, exploitability, and business impact. The critical internet-facing vulnerability is the most urgent.