Certified Information Systems Security Professional – CISSP – Question211

How should an organization determine the priority of its remediation efforts after a vulnerability assessment has been conducted?

A.
Use an impact-based approach.
B. Use a risk-based approach.
C. Use a criticality-based approach.
D. Use a threat-based approach.

Correct Answer: B