Security leadership wants a ransomware statement applied to every public-facing web application entity. Which configuration achieves that scoping?
Select an answer to reveal the explanation.
Short Explanation
Scoping is the mailing list for the statement. Point it at the public web-app entity type or filter, and each matching entity gets its own risk from the same ransomware wording.
Full Explanation
Applying one ransomware statement to every public-facing web application is done by scoping that statement to the entity type or filter that represents those applications so risks generate for the matching set. Scoping is the generation mailing list: correct filters produce consistent entity-level risks without manual paste operations across the municipal estate.
Scoping only to a single retired test entity fails production coverage and teaches the wrong pattern. Pasting statement text into each application’s description field manually abandons generation and creates drift. Creating one enterprise-wide risk with no entity relationship ignores application entities and destroys entity-level ownership and residual tracking.
Exam caveat: enterprise orphan risks without entity links are not a substitute for scoped generation. CIS-RC emphasizes statement scoping to entity sets.
Operational check: define the public web-app entity filter; attach it to the ransomware statement scope; generate risks; spot-check that retired or internal-only apps are excluded and that each in-scope app has its own risk record.
For public web applications, re-validate the entity filter whenever CMDB classes or business services change so newly exposed citizen portals inherit the ransomware statement without waiting for a manual campaign. Generation reports should list in-scope versus excluded entities after each scoping change, giving security leadership an auditable roster of which municipal apps carry the canonical ransomware risk. That operational roster is what makes scoped generation trustworthy at city scale.