A penetration tester runs a vulnerability scan that identifies several issues across numerous customer hosts.
The executive report outlines the following:

The client is concerned about the availability of its consumer-facing production application. Which of the following hosts should the penetration tester select for additional manual testing?
Correct Answer: C
Since the client is worried about the availability of their consumer-facing application, the perimeter network web server (Server 3) is the most critical because:
It is internet-facing, making it a prime target for attackers.
A compromise could lead to data breaches, downtime, or service disruptions.
Even though it has fewer vulnerabilities (14 vs. 92 on QA server), its exposure is higher.
Option A (Development sandbox server) #: Internal and not publicly accessible.
Option B (Back-office file transfer server) #: Important, but not consumer-facing.
Option C (Perimeter web server) #: Correct. Publicly accessible and critical to operations.
Option D (Developer QA server) #: May have more vulnerabilities, but it's less critical.
# Reference: CompTIA PenTest+ PT0-003 Official Guide - Prioritizing Vulnerability Testing