Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:
It is internet-facing, making it a prime target for attackers.
A compromise could lead to data breaches, downtime, or service disruptions.
Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.
Option A (Development sandbox server) ❌: Internal and not publicly accessible.
Option B (Back-office file transfer server) ❌: Important, but not consumer-facing.
Option C (Perimeter web server) ✅: Correct. Publicly accessible and critical to operations.
Option D (Developer QA server) ❌: May have more vulnerabilities, but it’s less critical.
???? Reference: CompTIA PenTest+ PT0-003 Official Guide – Prioritizing Vulnerability Testing
Submit