When taking a risk-based approach to vulnerability management, which of the following is MOST important to consider when prioritizing a vulnerability?

Question

Options

• AIT resource availability and constraints
• BWhether patches have been released and tested
• CThe information available about the vulnerability
• DThe sensitivity of the asset and the data it contains

• A
  8% (2)
• B
  4% (1)
• C
  15% (4)
• D
  73% (19)

Explanation

A risk-based approach to vulnerability management centers on impact - and the sensitivity of an asset and its data directly determines how severe the consequences of exploitation would be, making it the core prioritization factor. A critical vulnerability on a server holding encrypted backups poses far less risk than a moderate vulnerability on a system processing payment card data or PHI.

Why the distractors fall short:

• A (IT resource availability): Resource constraints are operational considerations that affect scheduling remediation, not prioritizing which vulnerabilities matter most from a risk standpoint.
• B (Patch availability): Knowing a patch exists informs remediation options, but an unpatched low-risk system may still warrant lower priority than a high-sensitivity asset with an available fix.
• C (Information about the vulnerability): CVSS scores and exploit details are useful inputs, but vulnerability severity alone doesn't account for your environment - a critical CVE on an isolated, low-value asset may still rank below a medium CVE on a crown-jewel system.

Memory tip: Think of the formula Risk = Threat × Vulnerability × Impact. Asset sensitivity drives the Impact variable - and in risk-based prioritization, impact (what you stand to lose) always anchors the calculation. Ask yourself: "What's the worst that happens if this gets exploited?" - that answer lives in the asset's sensitivity.

No community discussion yet for this question.