During a city risk meeting, staff treat a high CVSS number as the complete WLAN risk rating and ignore likelihood and local business impact. What correction is needed?
Select an answer to reveal the explanation.
Short Explanation
CVSS is a useful thermometer, not the whole diagnosis. City risk still needs 'will this hit us?' and 'how bad for our services?'—likelihood plus impact, not a number in isolation.
Full Explanation
During a city risk meeting, treating a high CVSS number as the complete WLAN risk rating while ignoring likelihood and local business impact needs correction: determine WLAN risk as a combination of likelihood and organizational impact, not CVSS alone. CVSS is a useful severity input, but municipal risk also depends on exposure, compensating controls, asset criticality (for example, payment or public-safety WLAN), and exploitability in the local architecture. Replacing all risk analysis with the single highest CVSS score in a vendor marketing PDF abandons local context. Using only the number of SSIDs as the risk score is arbitrary. Declaring CVSS obsolete and stopping vulnerability advisory reading throws away valuable severity data instead of integrating it. Mature civic risk discussions use CVSS plus environmental modifiers and business impact. Exam caveat: exam language consistently rejects CVSS-as-sole-answer thinking in favor of likelihood × impact with local context. Operational check: for each WLAN finding, record CVSS or vendor severity, then explicitly document exposure, criticality, and compensating controls before assigning residual risk and patch SLA; present that combined view to the city risk meeting.