When prioritizing targets, if one machine is Windows 7 unpatched with EternalBlue and another is fully patched Windows 10, where should you focus?

• A. The Windows 7 machine
• B. The Windows 10 machine
• C. The customer database directly
• D. A randomly chosen host

Answer: (A)

Prioritize the target with the highest exploitability given the current patch status. EternalBlue is a remote code execution flaw in SMB that became famous for its wormable behavior—if a machine is vulnerable and exposed on the network, an attacker can compromise it remotely and often move laterally to others. An unpatched Windows 7 system presenting this flaw represents immediate and widespread risk because it can be exploited from the network and potentially compromise additional hosts. A fully patched Windows 10 machine is protected against this specific vulnerability, so its risk from EternalBlue is far lower. The customer database is highly valuable, but without an initial foothold on a vulnerable host, direct access to the database isn’t as immediately actionable as taking down the most exploitable entry point. A randomly chosen host lacks a rational basis for prioritization compared to addressing the system with the known, dangerous vulnerability.