CySA+ Practice Exam.
Free practice test — 31 verified questions, instant feedback.
Know the exam before you sit it
the facts most prep sites buryEvery free resource for this exam
family overview →Get a free CySA+ study plan
A week-by-week plan plus new practice questions, straight to your inbox.
Frequently asked questions
How many questions are on the CySA+ (CS0-003) exam, and how long do I have?
The CS0-003 exam contains a maximum of 85 questions, and you're given 165 minutes to complete it. That works out to just under two minutes per question if you hit the maximum, so pace yourself and flag anything you're unsure of to revisit at the end. The questions are a mix of standard multiple-choice items and performance-based questions (PBQs) — the PBQs are hands-on simulations that typically appear first and can eat up time, so budget accordingly rather than getting stuck early.
What score do I need to pass CySA+?
You need a score of 750 on a scale of 100–900 to pass. Note that this is a scaled score, not a raw percentage — you don't need to answer 750 out of some number of questions, and the raw number of correct answers required isn't published, so treat any "you need X% correct" claim you see online with skepticism. The scale bottoms out at 100 (not 0), so 750 represents strong-but-not-perfect performance. Focus on mastering the four exam domains rather than chasing an exact percentage target.
What topics does the CySA+ exam cover, and how should I weight my study time?
CySA+ (CS0-003) is broken into four domains: Security Operations (33%), Vulnerability Management (30%), Incident Response Management (20%), and Reporting and Communication (17%). Security Operations and Vulnerability Management together make up 63% of the exam, so that's where the bulk of your study time should go. The certification is designed to validate your ability to detect, analyze, and respond to cybersecurity threats, and it targets professionals working in a Security Analyst role — so expect scenario-driven questions grounded in real analyst workflows rather than pure memorization.
Where do I take the exam, and how long does the certification stay valid?
Pearson VUE is the official test delivery provider for CompTIA exams, including CySA+, and you can take it either at a physical Pearson VUE test center or through online proctored delivery (OnVUE) from home. Once you pass, the certification is valid for three years from your certification date. You don't have to retake the exam to stay certified — you can renew by earning Continuing Education Units (CEUs), so plan to log qualifying activities throughout the three-year window rather than scrambling at the end.
Browse all questions & answers
1. A SOC analyst notices that a Windows workstation is repeatedly resolving DNS queries for domains with high entropy (e.g., xkq93jf.badnet.com) at short, regular intervals. Which technique is MOST likely being observed?
- A. A domain generation algorithm (DGA) used by malware to locate a command-and-control server
- B. Normal DNS caching behavior by the operating system
- C. A legitimate content delivery network performing load balancing
- D. DNS zone transfer between authoritative name servers
Show answer & explanation
Answer: A
High-entropy, algorithmically generated domain names queried at regular intervals are a classic indicator of a DGA, which malware uses to evade static blocklists while finding its C2 infrastructure. DNS caching does not produce novel random-looking domains, CDNs use recognizable branded domains, and zone transfers occur between name servers (AXFR/IXFR) rather than from an endpoint querying external random names.2. During log review, an analyst sees a spike in outbound traffic on port 443 from a server that normally only receives inbound HTTPS connections. What is the BEST next step?
- A. Ignore it since port 443 is always associated with legitimate encrypted web traffic
- B. Investigate the anomaly further, including reviewing the destination IP reputation and process making the connection
- C. Immediately reformat the server without further analysis
- D. Block all outbound traffic on the network to contain any possible threat
Show answer & explanation
Answer: B
A behavioral change (a normally inbound-only server suddenly generating outbound traffic) warrants investigation before any containment or eradication action; encryption on a common port does not guarantee legitimacy since attackers frequently use 443 for encrypted exfiltration or C2. Ignoring the anomaly risks missing a real compromise, reformatting destroys evidence and is premature, and blocking all outbound traffic network-wide is a disproportionate response to an unconfirmed single-host anomaly.3. An analyst is tuning a SIEM's correlation rules after a period of high false-positive alerts from a threat-intel-fed rule flagging any connection to IPs on a public blocklist. Which action BEST improves signal quality without reducing overall detection coverage?
- A. Disable the rule entirely so analysts stop seeing alerts from it
- B. Add contextual conditions (e.g., requiring the connection to originate from a sensitive asset or include unusual data volume) before the rule fires
- C. Increase the alert severity so every match pages the on-call analyst immediately
- D. Remove the threat intelligence feed from the SIEM entirely
Show answer & explanation
Answer: B
Adding contextual enrichment (asset criticality, behavioral thresholds) narrows a noisy rule to higher-fidelity conditions while preserving detection capability, which is a standard SIEM tuning practice. Disabling the rule or removing the feed eliminates detection coverage entirely, and raising severity without improving precision only worsens alert fatigue by escalating more false positives.4. A threat hunter wants to proactively search for adversary behavior that has not yet triggered any automated alert. Which approach BEST describes this activity?
- A. Running a scheduled vulnerability scan against all subnets
- B. Formulating a hypothesis based on known TTPs and searching telemetry for matching evidence
- C. Waiting for the SIEM to generate an alert and then investigating it
- D. Patching all systems flagged as high-risk by the last scan
Show answer & explanation
Answer: B
Threat hunting is a proactive, hypothesis-driven process where the analyst uses knowledge of adversary tactics, techniques, and procedures (often mapped to frameworks like MITRE ATT&CK) to search telemetry for evidence that automated detections may have missed. Vulnerability scanning identifies weaknesses rather than active adversary behavior, reactive alert triage is not proactive hunting, and patching is a remediation activity, not detection.5. An analyst is deploying a host-based detection tool that must observe process creation, file modification, and registry changes on endpoints in real time. Which technology BEST fits this requirement?
- A. Endpoint Detection and Response (EDR)
- B. A network-based intrusion prevention system (NIPS) only
- C. A web application firewall (WAF)
- D. An email gateway spam filter
Show answer & explanation
Answer: A
EDR agents run on the host itself and provide deep visibility into process execution, file system, and registry activity, along with response capabilities like isolation. A NIPS inspects network traffic rather than host-level OS activity, a WAF protects web applications from HTTP-layer attacks, and an email gateway filters messages rather than monitoring endpoint behavior.6. A security analyst reviewing NetFlow data notices a workstation transferring large volumes of data to an external IP over several hours during off-business hours. Assuming no known business justification exists, this pattern MOST strongly suggests which activity?
- A. Routine Windows Update traffic
- B. Data exfiltration
- C. A DHCP lease renewal
- D. ARP resolution broadcast traffic
Show answer & explanation
Answer: B
Sustained, large-volume outbound transfers to an external destination during off-hours with no legitimate business reason is a hallmark indicator of data exfiltration, often used by threat hunters as a behavioral anomaly to investigate. Windows Update traffic is typically smaller and follows recognizable Microsoft endpoints, DHCP lease renewals are small and periodic broadcast/unicast exchanges, and ARP is confined to the local broadcast domain and cannot explain sustained external transfer.7. Which of the following is the PRIMARY benefit of mapping detected adversary behavior to the MITRE ATT&CK framework during security operations?
- A. It guarantees that all zero-day exploits will be automatically blocked
- B. It provides a common taxonomy of tactics and techniques that helps standardize detection engineering and gap analysis
- C. It replaces the need for a SIEM entirely
- D. It eliminates the need for any human analyst review
Show answer & explanation
Answer: B
ATT&CK provides a shared, structured vocabulary of adversary tactics and techniques that analysts use to map detections, identify coverage gaps, and communicate findings consistently across teams. It does not block zero-days on its own, does not replace SIEM tooling (which remains the mechanism for collecting and correlating telemetry), and does not eliminate the need for human analysis and judgment.8. An analyst configures a rule to alert whenever a service account that normally only runs batch jobs at 2 AM authenticates interactively during business hours. This is an example of which detection approach?
- A. Signature-based detection
- B. Behavioral/anomaly-based detection using a baseline of normal activity
- C. Passive vulnerability scanning
- D. Static malware analysis
Show answer & explanation
Answer: B
Comparing observed activity against an established baseline of normal behavior (a service account's typical login pattern) to flag deviations is the definition of behavioral/anomaly-based detection. Signature-based detection matches known patterns of malicious code or traffic rather than behavioral baselines, passive vulnerability scanning identifies weaknesses without analyzing runtime behavior, and static malware analysis examines file characteristics without execution.9. A CySA+ candidate is asked why organizations deploy deception technology such as honeypots within a production network segment. What is the PRIMARY purpose?
- A. To permanently replace production servers
- B. To attract and detect attacker activity early by presenting an enticing but monitored fake target
- C. To provide additional bandwidth for legitimate users
- D. To automatically patch vulnerabilities on real production systems
Show answer & explanation
Answer: B
Honeypots and other deception assets are decoys designed to lure attackers so their reconnaissance and exploitation activity can be observed and alerted on early, without risk to real production data. They are not meant to serve legitimate business traffic, do not add usable bandwidth, and have no mechanism to patch vulnerabilities elsewhere in the environment.10. A vulnerability scan returns a critical CVSS score for a missing patch on an internal file server that is accessible only from a tightly controlled management VLAN with no direct user or internet access. How should the analyst MOST appropriately factor this exposure into prioritization?
- A. Prioritize it identically to an internet-facing system with the same CVSS base score, since CVSS alone determines priority
- B. Adjust priority downward relative to an equivalent internet-facing vulnerability, since compensating network controls reduce practical exploitability
- C. Ignore the finding completely because internal systems are never attacked
- D. Escalate it as the single highest priority in the organization regardless of other findings
Show answer & explanation
Answer: B
Effective vulnerability management considers environmental context (CVSS environmental/temporal factors) alongside the base score; restricted network access meaningfully lowers real-world exploitability compared to an equivalent internet-facing flaw, so relative prioritization should reflect that. Treating CVSS base score as the sole determinant, ignoring the finding outright, or blindly escalating it above all else in a limited-exposure context all fail to properly apply risk-based prioritization.11. An organization's vulnerability scanner reports a finding that later proves not to be exploitable because the vulnerable service is disabled on the host. What is this scan result BEST classified as?
- A. A true positive
- B. A false positive
- C. A false negative
- D. A true negative
Show answer & explanation
Answer: B
A false positive occurs when a scanner reports a vulnerability that does not actually pose risk under real conditions, as is the case here since the vulnerable service is disabled and therefore not exploitable. A true positive would mean the vulnerability is genuinely present and exploitable, a false negative would mean an actual vulnerability was missed by the scan, and a true negative means no vulnerability existed and none was reported.12. When prioritizing remediation across hundreds of scan findings, which combination of factors gives the MOST risk-accurate prioritization?
- A. CVSS base score alone
- B. Alphabetical order of the CVE identifiers
- C. CVSS score combined with asset criticality, exposure, and known active exploitation
- D. The order in which the scan tool listed the findings
Show answer & explanation
Answer: C
Risk-based vulnerability prioritization combines the technical severity (CVSS) with business context such as asset criticality, network exposure, and threat intelligence on active exploitation to determine true organizational risk, rather than relying on any single or arbitrary factor. CVSS alone ignores business context, alphabetical CVE ordering and default tool output order have no bearing on actual risk and are effectively random with respect to prioritization.13. A web application scan flags a parameter as vulnerable to SQL injection. Which remediation is MOST effective at addressing the root cause rather than just masking symptoms?
- A. Hiding error messages returned by the database
- B. Using parameterized queries (prepared statements) for all database interactions
- C. Renaming the vulnerable parameter to something less obvious
- D. Increasing the web server's request timeout value
Show answer & explanation
Answer: B
Parameterized queries separate SQL code from user-supplied data so injected input cannot be interpreted as executable SQL, directly addressing the root cause of SQL injection. Hiding error messages reduces information disclosure but does not stop the injection itself, renaming a parameter is security through obscurity and trivially bypassed, and adjusting request timeouts has no bearing on how input is parsed by the database.14. An analyst compares two vulnerabilities with identical CVSS base scores of 8.8. Vulnerability A has a publicly available working exploit and is being actively used in the wild; Vulnerability B has no known public exploit. How should this affect remediation prioritization?
- A. Both should be treated identically since CVSS scores are equal
- B. Vulnerability B should be prioritized higher because it is less understood
- C. Vulnerability A should be prioritized higher due to confirmed active exploitation increasing real-world risk
- D. Neither should be prioritized until a third vulnerability is found for comparison
Show answer & explanation
Answer: C
Threat intelligence about active, real-world exploitation is a temporal/contextual factor that increases actual risk beyond the static base score, so Vulnerability A represents a more urgent, immediate threat and should be remediated first. Treating both identically ignores available threat context, prioritizing the less-understood one over the actively exploited one inverts real risk, and there's no reason prioritization must wait on unrelated findings.15. Which scanning approach requires valid login credentials to the target system and typically yields more accurate results by inspecting installed software, patch levels, and configuration directly?
- A. Uncredentialed (unauthenticated) scanning
- B. Credentialed (authenticated) scanning
- C. Passive network scanning only
- D. Port scanning without service detection
Show answer & explanation
Answer: B
Credentialed scans log into the target with valid credentials, allowing the scanner to enumerate installed packages, patch levels, and local configuration directly, producing far fewer false positives/negatives than external probing alone. Uncredentialed scans only see what's exposed externally, passive scanning merely observes traffic without actively querying configuration, and basic port scanning without service detection reveals only open ports, not patch or configuration state.16. A vulnerability management program wants to reduce its attack surface on a legacy server that cannot be patched due to vendor end-of-life. Which compensating control is MOST appropriate?
- A. Do nothing since patching is impossible
- B. Isolate the server on a segmented network with strict access control lists and enhanced monitoring
- C. Expose the server directly to the internet to simplify remote access
- D. Disable all logging on the server to reduce noise
Show answer & explanation
Answer: B
When patching is not possible, isolating the asset behind network segmentation with restrictive ACLs and heightened monitoring is a standard compensating control that reduces exploitability and improves detection of any attempted attack. Doing nothing leaves the vulnerability fully exposed, exposing the server to the internet dramatically increases risk, and disabling logging removes the visibility needed to detect exploitation attempts on an unpatchable system.17. During a vulnerability assessment, an analyst identifies that a legacy protocol (Telnet) is enabled on several network devices, transmitting credentials in cleartext. What is the BEST remediation recommendation?
- A. Leave Telnet enabled but require longer passwords
- B. Disable Telnet and replace it with SSH for encrypted management access
- C. Restrict Telnet to only IPv6 addresses
- D. Change the default Telnet port number to a non-standard port
Show answer & explanation
Answer: B
Telnet's fundamental weakness is that it transmits all data, including credentials, in cleartext; the only effective remediation is replacing it with an encrypted protocol like SSH. Longer passwords, IPv6 restriction, or changing the port do nothing to encrypt the traffic itself and leave credentials just as exposed to interception.18. An organization's cloud infrastructure scan reveals a storage bucket configured with public read access containing sensitive customer records. From a vulnerability management perspective, what is the MOST accurate characterization of this finding?
- A. A low-severity configuration issue with no real risk
- B. A critical misconfiguration representing a data exposure risk requiring immediate remediation
- C. An expected and acceptable default state for cloud storage
- D. A finding that only affects availability, not confidentiality
Show answer & explanation
Answer: B
A publicly readable storage bucket containing sensitive records is a serious confidentiality-impacting misconfiguration since anyone on the internet could access customer data, warranting urgent remediation (restricting access and auditing for prior exposure). It is not low severity or an acceptable default, and its primary impact is on confidentiality (unauthorized disclosure), not availability.19. A patch management team must decide how to handle a vendor-released patch for a critical remote code execution vulnerability affecting a business-critical production application. Testing shows the patch may break a custom integration. What is the BEST course of action?
- A. Apply the patch to production immediately without testing to close the vulnerability as fast as possible
- B. Never apply the patch since it might break the integration
- C. Test the patch in a staging environment, coordinate remediation of the integration issue, and apply compensating controls until the patch can be safely deployed
- D. Uninstall the custom integration permanently without informing stakeholders
Show answer & explanation
Answer: C
Balanced vulnerability management requires validating patches in a non-production environment, working with stakeholders to resolve compatibility issues, and applying compensating controls (e.g., additional monitoring or network restrictions) to manage risk during the interim, rather than choosing an extreme of immediate unvalidated deployment or indefinite delay. Applying untested patches to production risks an outage, refusing to patch leaves a critical RCE open indefinitely, and unilaterally removing business functionality without stakeholder input is an inappropriate and disruptive shortcut.20. Which of the following BEST describes the purpose of penetration testing in relation to vulnerability scanning within a vulnerability management program?
- A. Penetration testing replaces the need for any vulnerability scanning
- B. Penetration testing actively attempts to exploit identified weaknesses to validate real-world impact, complementing the broader coverage of automated scanning
- C. Penetration testing is only performed by automated tools with no human involvement
- D. Penetration testing and vulnerability scanning always test only web applications
Show answer & explanation
Answer: B
Vulnerability scanning provides broad, automated identification of potential weaknesses, while penetration testing goes further by having skilled testers actively attempt exploitation to demonstrate real business impact and validate whether a vulnerability is truly exploitable in context; the two are complementary, not substitutes. Pen testing does not replace scanning's breadth, it typically involves significant manual tester expertise rather than being purely automated, and both practices apply to networks, endpoints, and cloud infrastructure, not solely web applications.21. An incident responder is analyzing a suspected ransomware infection. Which action should be taken FIRST to limit damage while preserving the ability to investigate?
- A. Power off the affected system completely before any analysis
- B. Isolate the affected host from the network (e.g., disable its network interface) while keeping it powered on for potential memory analysis
- C. Delete all files on the host immediately to stop the spread
- D. Wait 24 hours to observe further behavior before taking any action
Show answer & explanation
Answer: B
Network isolation stops the ransomware from spreading laterally or continuing to communicate with C2 infrastructure while keeping the system powered on preserves volatile memory that may contain encryption keys or forensic artifacts. Powering off immediately can destroy volatile evidence in RAM, deleting files destroys evidence and does not address the root infection, and waiting 24 hours allows continued spread and data loss during active ransomware activity.22. During incident response, which order BEST reflects the standard phases of the incident response lifecycle as commonly taught?
- A. Eradication, Preparation, Containment, Detection, Recovery, Lessons Learned
- B. Preparation, Detection and Analysis, Containment/Eradication/Recovery, Post-Incident Activity (Lessons Learned)
- C. Recovery, Containment, Detection, Preparation, Eradication, Lessons Learned
- D. Lessons Learned, Preparation, Detection, Eradication, Containment, Recovery
Show answer & explanation
Answer: B
The widely recognized incident response lifecycle begins with Preparation (readiness before an incident), followed by Detection and Analysis, then Containment, Eradication, and Recovery, and finally Post-Incident Activity/Lessons Learned to improve future response; the other orderings scramble this logical sequence in ways that don't reflect how a real incident actually needs to be handled (e.g., you cannot contain a threat before detecting it, and lessons learned must come after recovery, not before preparation).23. An analyst is calculating chain of custody documentation while collecting a forensic disk image from a compromised server. What is the PRIMARY reason this documentation is critical?
- A. It speeds up the imaging process technically
- B. It establishes an unbroken record of who handled the evidence and when, supporting its admissibility and integrity
- C. It is only needed for external audits, not incident response
- D. It replaces the need for cryptographic hashing of the evidence
Show answer & explanation
Answer: B
Chain of custody documents every person who accessed, handled, or transferred evidence and when, which is essential for demonstrating the evidence has not been tampered with and remains legally admissible and trustworthy. It has no effect on the technical speed of imaging, it is relevant to internal incident response as well as any legal proceedings, and it complements rather than replaces cryptographic hashing (which verifies integrity of the data itself).24. A responder needs to preserve volatile data before it is lost during an active incident. Per the standard order of volatility, which of the following should generally be collected FIRST?
- A. Data on backup tapes stored offsite
- B. Contents of RAM and active network connections
- C. Files stored on the local hard disk
- D. Printed documentation in the server room
Show answer & explanation
Answer: B
The order of volatility prioritizes collecting the most transient data first; RAM contents and active network connections/state disappear the moment a system is powered off or a session ends, making them the highest priority to capture. Disk-based files persist after shutdown and can be imaged later, backup tapes are already durable long-term storage, and printed documentation is entirely static and non-volatile.25. An incident response team determines that an attacker gained access via a phished credential and has been dormant in the environment for several weeks, moving laterally between systems. Which containment strategy BEST balances stopping further damage with preserving evidence for full scope determination?
- A. Immediately terminate all user accounts across the entire organization
- B. Take no containment action until the full scope of compromise is confirmed with certainty
- C. Apply targeted containment (disabling the compromised account, isolating known-affected hosts) while continuing to monitor for additional indicators before full eradication
- D. Immediately wipe and rebuild every server in the environment without further investigation
Show answer & explanation
Answer: C
Targeted containment addresses known compromised accounts and hosts to limit further lateral movement while preserving the broader environment for continued monitoring and investigation to fully scope the incident before eradication — this mirrors real-world guidance to contain proportionally rather than overreact or underreact. Disabling every account organization-wide is disruptive and unnecessary, waiting for absolute certainty allows continued attacker activity, and wiping every server destroys evidence and is a wildly disproportionate response before scope is even understood.26. A company's incident response plan requires notifying specific regulatory bodies within a defined time window after confirming a breach involving personal data. Which document or process would MOST likely define this specific obligation?
- A. The organization's data breach notification policy, informed by applicable legal/regulatory requirements
- B. The vulnerability scanning schedule
- C. The company's marketing brand style guide
- D. The network diagram maintained by IT operations
Show answer & explanation
Answer: A
A breach notification policy, shaped by applicable regulations (such as data protection laws), is the document that defines who must be notified, what must be disclosed, and within what timeframe following a confirmed data breach. A vulnerability scanning schedule concerns proactive testing cadence, a brand style guide governs marketing appearance, and a network diagram documents infrastructure topology — none of these define legal notification obligations.27. During post-incident review (lessons learned), the team identifies that a critical alert was missed because analysts were overwhelmed by low-fidelity noise from a poorly tuned rule. What is the MOST appropriate long-term corrective action?
- A. Hire more analysts without changing any detection tuning
- B. Improve detection rule tuning and alert prioritization to reduce noise and surface high-fidelity alerts more effectively
- C. Remove the rule that generated the missed alert entirely so it never fires again
- D. Take no action since the incident has already been resolved
Show answer & explanation
Answer: B
Addressing root cause requires improving detection engineering (tuning rules, prioritizing high-confidence alerts) so genuine threats are not buried in noise going forward, which is a core outcome of the lessons-learned phase. Simply adding headcount without fixing the underlying noise problem is an incomplete fix, removing the very rule that could have caught the incident eliminates future detection capability, and taking no action ignores the purpose of post-incident review, which is continuous improvement.28. A CySA+ analyst is writing an executive summary of a recent security incident for senior leadership who are not technical. Which approach is MOST appropriate for this audience?
- A. Include full raw packet captures and unfiltered log dumps with no summarization
- B. Focus on business impact, risk, and remediation status in plain language, with technical detail available in an appendix if needed
- C. Use only technical jargon and CVE identifiers with no context
- D. Omit any mention of business impact since leadership only cares about technical root cause
Show answer & explanation
Answer: B
Effective security communication tailors depth and language to the audience; for executives, framing findings in terms of business impact, risk, and remediation status in plain language ensures the message drives informed decisions, with technical detail available separately for those who need it. Dumping raw technical artifacts or jargon-heavy content without context overwhelms a non-technical audience and obscures the message, while omitting business impact defeats the entire purpose of an executive-facing report.29. Which metric BEST measures how quickly a security operations team detects a threat after it first enters the environment?
- A. Mean Time to Detect (MTTD)
- B. Mean Time to Repair (MTTR) for hardware failures
- C. Return on Investment (ROI) of the SOC budget
- D. Number of open job requisitions on the security team
Show answer & explanation
Answer: A
Mean Time to Detect (MTTD) specifically measures the average time elapsed between a threat's initial presence in the environment and its discovery by the security team, making it the direct metric for detection speed. MTTR for hardware failures concerns equipment repair, not threat detection; SOC budget ROI measures financial efficiency rather than detection speed; and open job requisitions is an HR staffing metric unrelated to detection performance.30. A CySA+ analyst needs to communicate a newly discovered vulnerability to the software development team responsible for the affected application. Which element is MOST important to include to enable an effective and efficient fix?
- A. A general statement that 'security issues exist' with no further detail
- B. Specific reproduction steps, affected component/code location, and business risk context
- C. Only the CVSS numeric score with no other context
- D. A request to shut down the entire application indefinitely
Show answer & explanation
Answer: B
Developers need actionable detail — how to reproduce the issue, exactly where in the code or component it exists, and why it matters from a risk standpoint — to prioritize and fix the vulnerability efficiently. A vague statement gives them nothing to act on, a bare CVSS score without context or reproduction steps doesn't tell them what to fix or where, and demanding a full application shutdown is a disproportionate and usually unnecessary response to a single reported vulnerability.31. When communicating risk to a business stakeholder who must decide whether to accept, mitigate, transfer, or avoid a given risk, which framing is MOST useful?
- A. Describing risk purely in terms of technical CVE numbers with no likelihood or impact discussion
- B. Framing risk in terms of likelihood and potential business impact, alongside available response options and their costs
- C. Telling the stakeholder that the decision is not their responsibility
- D. Presenting only worst-case scenarios without discussing probability
Show answer & explanation
Answer: B
Effective risk communication for decision-makers translates technical findings into business terms — likelihood, potential impact, and the trade-offs of each response option (accept, mitigate, transfer, avoid) — so they can make an informed, risk-based decision. Reciting bare CVE identifiers provides no decision-relevant context, deflecting the decision away from the stakeholder who owns it is inappropriate, and presenting only worst-case outcomes without likelihood distorts the actual risk picture and undermines sound decision-making.