100-160 Question 173
Select 3A financial institution recently conducted a vulnerability assessment and discovered a critical vulnerability in its web application. The cybersecurity team must prioritize this issue. Which factors should be considered when determining the risk level of this vulnerability?
- A
The potential impact of exploitation on the confidentiality, integrity, and availability of the system
- B
The likelihood of exploitation, including ease of exploitability and availability of exploits
- C
The number of users who interact with the affected system daily
- D
The cost and resources required to remediate the vulnerability
- E
The compliance requirements or regulatory implications associated with the vulnerability
Show answer and explanation
Correct answers: A, B, E
Explanation
When prioritizing a vulnerability, the risk level is determined by assessing the potential impact on the organization (e.g., confidentiality, integrity, availability), the likelihood of exploitation, and compliance requirements. These factors help organizations focus on addressing the most critical vulnerabilities first to minimize potential harm.
- A. Correct.
Correct. The potential impact on confidentiality, integrity, and availability (CIA triad) is critical in assessing the severity of the vulnerability and its risk to the organization.
- B. Correct.
Correct. The likelihood of exploitation, including the ease with which an attacker can exploit the vulnerability and the availability of tools or scripts, is key to assessing risk.
- C. Incorrect.
Incorrect. While the number of users may provide some context, it is not a primary factor in determining the risk level of a vulnerability.
- D. Incorrect.
Incorrect. Although the cost of remediation is important for planning, it does not directly determine the risk posed by the vulnerability itself.
- E. Correct.
Correct. Compliance and regulatory requirements can significantly influence risk prioritization, as failure to address vulnerabilities may result in penalties or legal consequences.