{
  "kind": "synthetic-educational-scenario",
  "version": "1.0",
  "slug": "vulnerability-priority",
  "title": "Patch the right thing first",
  "description": "Three findings, a short maintenance window, and conflicting scores. Prioritize by exposure and consequence.",
  "minutes": 7,
  "skill": "Risk prioritization",
  "evidence": "SYNTHETIC QUEUE / VM-008\nFictional findings; scores are teaching inputs, not real CVEs.\n\nA / Internet-facing gateway\n    Severity 8.1; known exploitation in the wild.\n    Reaches employee sessions. Patch available; owner on call.\n\nB / Isolated development image\n    Severity 9.8; no current route from production or internet.\n    Exploit status unknown. Rebuild scheduled tomorrow.\n\nC / Internal billing service\n    Severity 6.5; authenticated access required.\n    Sensitive records; workaround available. Exposure review pending.\n\nYou can schedule one emergency change now.\nThe score measures technical severity, not your complete business risk.",
  "steps": [
    {
      "prompt": "Which finding is the strongest first candidate for the emergency window?",
      "choices": [
        {
          "text": "B, because the largest severity score always comes first.",
          "correct": false,
          "feedback": "Severity helps describe a weakness, but exposure, exploitation, and consequences affect the priority."
        },
        {
          "text": "A, because known exploitation and internet exposure create an urgent, actionable path.",
          "correct": true,
          "feedback": "A combines active threat, reachability, important sessions, and an available remedy. Confirm dependencies and the change plan before execution."
        },
        {
          "text": "C, because sensitive data is the only factor that matters.",
          "correct": false,
          "feedback": "Data sensitivity matters, but it does not remove the need to assess likelihood, access conditions, and active exploitation elsewhere."
        }
      ]
    },
    {
      "prompt": "What should you verify before applying the emergency change?",
      "choices": [
        {
          "text": "Only that the scanner will show a lower score.",
          "correct": false,
          "feedback": "The goal is reduced exposure while keeping the service recoverable, not an improved dashboard."
        },
        {
          "text": "Ownership, affected versions, patch applicability, rollback, and how you will verify the exposed path is closed.",
          "correct": true,
          "feedback": "This connects the chosen priority to a safe implementation and a measurable outcome."
        },
        {
          "text": "That nobody has ever reported a vulnerability in this vendor.",
          "correct": false,
          "feedback": "Vendor reputation does not establish patch applicability or the safety of this change."
        }
      ]
    },
    {
      "prompt": "How should B and C be handled while A is addressed?",
      "choices": [
        {
          "text": "Delete them from the queue because they were not selected.",
          "correct": false,
          "feedback": "Lower immediate priority is not zero risk. Keep ownership, deadlines, and the assumptions that justified the delay."
        },
        {
          "text": "Assign owners, confirm the isolation of B, assess C’s reachable sensitive path, and time-bound both follow-ups.",
          "correct": true,
          "feedback": "A defensible queue preserves uncertainty and ensures a temporary priority does not become indefinite neglect."
        },
        {
          "text": "Give both the same emergency deadline regardless of context.",
          "correct": false,
          "feedback": "A uniform deadline can hide differences in exposure and distract from the most urgent work."
        }
      ]
    }
  ],
  "takeaway": "Priority is a reasoned sequence of risk-reduction work. Use severity, exploitation, reachability, asset importance, and operational constraints together."
}