Having realistic goals for reducing vulnerabilities ________.

• A. is giving in to the problem
• B. helps to focus on the most critical threats
• C. is a cost-saving method
• D. is risk avoidance

Answer: (B)

Prioritizing vulnerabilities by risk means directing security work to the issues that would cause the most harm if exploited. When goals for reducing vulnerabilities are realistic, you can allocate limited resources to the most impactful problems rather than trying to fix every issue at once. This approach relies on evaluating likelihood and impact to identify which threats are the most critical, ensuring the security program protects against the highest risks.

This isn’t about giving in to the problem; it’s about making smart, actionable decisions with finite time and money. It’s not primarily a cost-saving method, though focusing on critical threats often reduces wasted effort. It’s not risk avoidance, since some risk remains even after fixes. By concentrating on the most dangerous vulnerabilities, you maximize protection where it matters most.