A security manager has asked an analyst to provide feedback on the results of a penetration test. After reviewing the results, the manager requests information regarding the possible exploitation of vulnerabilities. Which of the following information data points would be MOST useful for the analyst to provide to the security manager, who would then communicate the risk factors to senior management? (Choose two.)
A) Probability
B) Adversary capability
C) Attack vector
D) Impact
E) Classification
F) Indicators of compromise

Question

Quizplus · Accepted Answer

Probability and impact are the most useful information data points for the analyst to provide to the security manager, who would then communicate the risk factors to senior management. Probability refers to the likelihood of a vulnerability being exploited, while impact refers to the potential consequences of a successful exploitation. These two factors are essential for understanding the overall risk posed by a vulnerability and for making decisions about how to mitigate that risk.

A Security Manager Has Asked an Analyst to Provide Feedback