A risk assessment has been completed on an application and reported to the application owner. The report includes validated vulnerability findings that require mitigation. Which of the following…

Reporting findings to executive management typically occurs after risk responses have been considered or when specific decisions require executive approval, not immediately after the initial assessment.

Reassessing each vulnerability is redundant since the findings are already validated; the focus shifts to treatment rather than re-evaluation.

Conducting a penetration test is an assessment activity to identify vulnerabilities, not a mitigation step after vulnerabilities have already been identified and validated.

Once vulnerabilities are identified and validated, the application owner, in conjunction with the risk team, is responsible for preparing a risk response. This involves deciding whether to mitigate, accept, transfer, or avoid the risk, based on the organization's defined risk tolerance and strategy.