Question

A risk practitioner is reviewing findings from a recent penetration test that identified several exploitable weaknesses in a customer-facing web application. Multiple remediation actions have been proposed, but development capacity is limited this quarter. Which factor should MOST influence the sequence in which the remediation actions are implemented?

Accepted Answer

The level of risk reduction each action provides relative to the effort required

Answer

The chronological order in which the weaknesses were discovered during the test

Answer

The preference of the development team based on familiarity with each fix

Answer

The total number of separate weaknesses grouped under each application module