Which statement about vulnerability risk rankings is true?

Which statement about vulnerability risk rankings is true?

• A. Only low-risk vulnerabilities must be identified.
• B. All vulnerabilities must be identified, regardless of risk.
• C. At a minimum, high-risk vulnerabilities must be identified; critical vulnerabilities may be imminent threats.
• D. Risk rankings are optional.

Answer: (C)

Prioritizing remediation through risk ranking is how you manage vulnerability challenges. You identify vulnerabilities and evaluate how severe their impact would be and how likely they are to be exploited, then you focus first on the highest-risk items. That’s why at a minimum you must identify high‑risk vulnerabilities, and why critical vulnerabilities are treated as imminent threats requiring prompt action. This approach ensures limited resources are used where they reduce risk the most, rather than attempting to fix everything at once.

Prioritizing remediation through risk ranking is how you manage vulnerability challenges. You identify vulnerabilities and evaluate how severe their impact would be and how likely they are to be exploited, then you focus first on the highest-risk items. That’s why at a minimum you must identify high‑risk vulnerabilities, and why critical vulnerabilities are treated as imminent threats requiring prompt action. This approach ensures limited resources are used where they reduce risk the most, rather than attempting to fix everything at once.