A senior engineer reviews the current classification plan and finds that user population size was left out of every risk assessment. What is the consequence of this omission?
Select an answer to reveal the explanation.
Short Explanation
You can't ignore user population. A flaw affecting ten people isn't the same risk as one affecting ten million, so leaving population out can under-classify large-scale use cases.
Full Explanation
The correct answer is the option stating that use cases affecting large numbers of people may be under-classified, because the same flaw does more harm the more people it reaches. Scale of reach is one of the five classification dimensions, and omitting it means a widely deployed but flawed use case can end up with a risk tier that understates its real impact.
The option claiming there is no consequence is incorrect because user population is explicitly one of the classification dimensions, not an optional extra.
The option saying the omission only affects use cases deployed outside the organisation's home country is incorrect because reach affects risk regardless of geography.
The option saying the omission makes classification faster with no loss of accuracy is incorrect because the omission trades accuracy for speed, which is a real cost, not a free gain.
For the exam, treat every one of the five dimensions as required, since dropping any one degrades the classification.