100-160 Question 201
Single answerYour organization has identified a vulnerability in its web application that could allow attackers to perform SQL injection attacks. However, the web application is not publicly accessible and is only used by a small internal team. Based on this scenario, how should the associated risk be ranked, and what approach to risk management would be most appropriate?
- A
Rank the risk as high and immediately implement a vulnerability patch.
- B
Rank the risk as medium and monitor the application for suspicious activity.
- C
Rank the risk as low and document the vulnerability for future review.
- D
Rank the risk as extremely high and shut down the application until the vulnerability is fixed.
Show answer and explanation
Correct answer: C
Explanation
The risk ranking should consider both the likelihood of exploitation and the impact if the vulnerability is exploited. In this scenario, the likelihood is low because the application is not publicly accessible, and the impact is limited to a small internal team. This justifies ranking the risk as low and opting for documentation rather than immediate action or extreme measures like shutting down the application.
- A. Incorrect.
This option is incorrect because the application is not publicly accessible, and the limited exposure reduces the likelihood of exploitation. Immediate action may not be necessary in this scenario.
- B. Incorrect.
While monitoring is a viable strategy, ranking the risk as medium may overestimate the likelihood and impact of exploitation given the internal-only access.
- C. Correct.
This is the correct answer because the vulnerability exists, but the risk is low due to the mitigated exposure (internal-only access). Documenting the issue allows the organization to address it in future updates without allocating unnecessary immediate resources.
- D. Incorrect.
This option is incorrect because shutting down the application for a low-risk vulnerability would be an overreaction and could negatively impact the internal team's productivity.