You have 2,000 open vulnerabilities from a scan. How do you decide what to fix first?
What the interviewer wants to hear
- CVSS alone is not enough
- Use exploitation data such as CISA KEV and EPSS
- Consider asset exposure and business criticality
- Group fixes and set SLAs by risk
- Use compensating controls when patching is not possible
Model answer
I would not just sort by CVSS, because severity is not the same as risk. First I flag anything in the CISA Known Exploited Vulnerabilities catalog, since those are being used in real attacks. Then I use EPSS to see the probability of exploitation in the next 30 days. I combine that with asset context: is the system internet-facing, does it hold sensitive data, is it a domain controller or VPN gateway. An actively exploited flaw on an internet-facing device goes to the top with a short SLA, perhaps days. Many findings share one fix, like a single browser or OS update, so I group them for the owners. Where patching is not possible yet, I suggest compensating controls such as restricting access, WAF rules or disabling the vulnerable feature, and I track exceptions with an owner and end date.
Can you answer it under time pressure?
Take a timed medium round and get scored on every answer.
More medium Cybersecurity Analyst questions
- Walk me through how you triage a new SIEM or EDR alert.
- What is MITRE ATT&CK and how do you use it in your work?
- You suspect a Microsoft 365 user account is compromised. How do you investigate and respond?
- Your SOC gets too many false positive alerts. How would you reduce alert fatigue without missing real attacks?
- How do you write an incident report that works for both technical teams and non-technical leaders?
- A network alert says a laptop may be beaconing to a command-and-control server. How do you investigate?
- How do you use threat intelligence in day-to-day SOC work without drowning in indicator feeds?
- A critical vulnerability is being exploited in the wild, but the affected system cannot be patched for weeks. What do you do?
- EDR raises an alert for a suspicious PowerShell command on a user's laptop. Walk me through your investigation.