100-160 Question 203
Single answerA cybersecurity analyst discovers a vulnerability in a web application that could allow an attacker to execute malicious scripts. The likelihood of exploitation is high, and the web application handles sensitive customer data, including credit card information. How should the analyst prioritize this risk in a risk management process?
- A
Classify the risk as low and document it for future review.
- B
Classify the risk as medium and monitor it periodically.
- C
Classify the risk as high and recommend immediate mitigation actions.
- D
Classify the risk as extremely high and shut down the web application immediately.
Show answer and explanation
Correct answer: C
Explanation
The analyst should classify the risk as high because of the combination of a high likelihood of exploitation and the potential impact on sensitive customer data. Immediate mitigation actions, such as applying patches or implementing security controls, are crucial in addressing the vulnerability while maintaining the application's availability. Classifying the risk as either too low or too extreme would either underestimate or overestimate the situation, leading to inappropriate responses.
- A. Incorrect.
Classifying the risk as low is inappropriate since the likelihood is high, and the data at risk is sensitive (credit card information). This would underestimate the potential impact.
- B. Incorrect.
Classifying the risk as medium and only monitoring it does not align with the high likelihood and the critical nature of the data involved. This could delay necessary action.
- C. Correct.
Classifying the risk as high and recommending immediate mitigation actions is appropriate because the likelihood of exploitation is high, and the impact on sensitive data could be severe.
- D. Incorrect.
Classifying the risk as extremely high and immediately shutting down the web application might be an overreaction unless there is already evidence of active exploitation. Risk management aims to balance mitigation with operational needs.