Two WLAN flaws have similar impact: one needs rare physical console access; the other is a common remote wireless exploit. How should ratings differ?
Select an answer to reveal the explanation.
Short Explanation
Same crash damage, different odds of the crash—remote wireless is the busy highway; rare console access is a locked side alley. When impact matches, the common path gets the higher risk score. Likelihood is half the risk equation, not a footnote.
Full Explanation
When two WLAN flaws have similar impact, the common remote wireless exploit should be rated higher because greater likelihood raises overall risk. Always rating physical-console issues higher regardless of rarity ignores likelihood. Giving both identical ratings because impact alone defines risk discards half of the risk equation. Ignoring likelihood and ranking only by CVE description length is arbitrary and nonanalytical. Exam caveat: likelihood differentiates otherwise equal-impact findings—remote reachability typically elevates priority versus rare physical access, all else equal. Operational check: document both findings with impact parity noted, elevate the remote exploit in the risk register, assign faster remediation SLAs, and verify compensating WIPS/monitoring while patches deploy. Keep the rationale in the municipal risk workshop notes so auditors see why priorities differ. In municipal WLAN operations, record the rationale in the change ticket so future on-call staff know which control was chosen and which failure modes the rejected options would create for city services. Re-validate after the next maintenance window that the same control still holds under the infrastructure versions and client fleets used by the civic environment.