Which is the BEST way to measure and prioritize aggregate risk deriving from a chain of linked
system vulnerabilities?

A.
Vulnerability scans

B.
Penetration tests

C.
Code reviews

D.
Security audits

Explanation:

A penetration test is normally the only security assessment that can link vulnerabilities together by
exploiting them sequentially. This gives a good measurement and prioritization of risks. Other
security assessments such as vulnerability scans, code reviews and security audits can help give
an extensive and thorough risk and vulnerability overview’, but will not be able to test or
demonstrate the final consequence of having several vulnerabilities linked together. Penetration
testing can give risk a new perspective and prioritize based on the end result of a sequence of
security problems.