SAST and SCA flooded the backlog after a civic services scan. How should the team prioritize remediation?
Select an answer to reveal the explanation.
Short Explanation
Not every finding is a five-alarm fire at city hall. Rank what an attacker could actually use against what would hurt residents most—outages, data loss, fraud. Exploitability plus civic impact beats sorting by vibes or file name.
Full Explanation
When SAST and SCA flood a civic-services backlog, remediation must be prioritized by exploitability and business impact on residents and city operations—not by convenience or cosmetics. A remotely exploitable injection on an authenticated payments path outranks a low-confidence style finding in an internal admin theme. Impact considers confidentiality of citizen data, integrity of transactions, availability of mandated services, and regulatory exposure. Exploitability considers reachability, privileges required, and whether a known exploit exists for a dependency CVE.
Alphabetical order of file names for fairness ignores risk entirely and can delay fixing the most dangerous issues while teams polish harmless paths.
Fixing only cosmetic UI findings before exploitable flaws inverts triage and leaves real attack paths open while effort goes to appearance.
Closing every ticket as accepted risk without analysis is negligence dressed as efficiency; acceptance requires informed owners, residual risk documentation, and time bounds—not bulk dismissal.
Exam caveat: risk-based prioritization is a core CISSP theme—severity labels alone are weaker than exploitability plus business impact on civic services. Operational check: define SLAs by severity/impact tiers, score findings with environmental context (internet-facing vs. internal), track mean time to remediate criticals, and escalate overdue exploitable items that affect permitting, benefits, or billing.