CompTIA PenTest+ PT0-002 Practice Question

The most accurate strategy for risk prioritization involves combining the likelihood of exploitation with the potential impact on the business. While all answers could somewhat guide the prioritization, the best method is the one that takes into account both how likely the vulnerability is to be exploited and what the consequences of that exploitation would be. This allows for a balanced approach that prioritizes the most significant risks. Simple ranking by severity may not account for the business context, ordering by ease of fix might let critical vulnerabilities remain unaddressed for longer, and prioritizing based on recent trends in exploits could overlook major vulnerabilities that haven't been exploited recently but pose a significant risk.