A vulnerability report for the business-license portal lists CVSS scores but no owners or deadlines. What must reporting add to drive remediation?
Select an answer to reveal the explanation.
Short Explanation
Severity without a name and a date is a sticky note that never gets done. Assign owners and due dates. Inflating scores, erasing deadlines, or a nameless inbox will not close portal findings.
Full Explanation
Effective test reporting analyzes output and drives remediation by pairing findings with accountable owners and target dates. A vulnerability report for the business-license portal that lists CVSS scores but no owners or deadlines informs severity without creating workflow. Adding clear remediation owners and due dates for each finding—not severity scores alone—converts assessment output into tracked work that closes risk for a citizen-facing licensing system.
Inflating scores with no assignment increases apparent urgency without creating accountability, so nothing actually moves. Removing all dates to keep the backlog ‘flexible forever’ guarantees indefinite deferral. A single shared inbox with no individual accountability diffuses responsibility until findings age out unread.
Exam caveat: Reporting must support remediation workflow. Severity without ownership and deadlines is a common distractor pattern; choose answers that assign owners and dates.
Operational check: For each portal finding, record severity, business impact, named owner, due date, and status in the ticketing system; escalate overdue criticals to management review; and refuse to accept ‘score-only’ vendor reports without an ownership plan.