CompTIA CySA+ CS0-003 Practice Question

Risk score is the correct answer because it quantifies the potential impact and likelihood of a vulnerability being exploited. This scoring often uses industry-standard metrics such as CVSS (Common Vulnerability Scoring System) which provides a clear and standardized method for prioritizing vulnerabilities based on their severity. This score is universally understood by stakeholders and can directly influence the prioritization and response efforts. In contrast, the affected hosts merely indicate which hosts are vulnerable without providing information on the severity of the vulnerability. Mitigation steps provide a potential solution but do not communicate the criticality. Recurrence indicates how often the vulnerability appears, which also does not directly communicate the criticality of an individual vulnerability.