A key aspect of recommending attack remediation strategies is:

Question

Options

• AEnsuring they are the least disruptive to business operations
• BMaking them as complex as possible
• CFocusing solely on external threats
• DIgnoring the cost implications

• A
  87% (33)
• B
  8% (3)
• C
  3% (1)
• D
  3% (1)

Explanation

Recommending attack remediation strategies must always balance security effectiveness with real-world business constraints - a fix that cripples operations may cause more harm than the original vulnerability. Option A is correct because security professionals serve the organization, and remediation that unnecessarily disrupts workflows, revenue, or critical services will be rejected or poorly implemented, leaving the organization exposed anyway.

Why the distractors are wrong:

• B - Complexity is a liability, not a virtue; simpler remediations are easier to implement correctly and maintain.
• C - Internal threats (insider threats, misconfigured systems, lateral movement) are equally critical and often more damaging than external ones.
• D - Cost is a primary factor in every security decision; ignoring it produces recommendations that organizations cannot or will not fund.

Memory tip: Think of remediation advice like a doctor's prescription - the best treatment is one the patient will actually follow. A cure that shuts down the patient isn't a cure.

No community discussion yet for this question.