The process to ID security vulnerabilities should include which elements?

• A. Identify new vulnerabilities
• B. Assign a risk ranking including high/critical
• C. Use reputable outside sources for vulnerability information
• D. All of the above

Answer: (D)

Identifying vulnerabilities effectively means more than just finding flaws; you need a complete process that covers discovering new vulnerabilities, prioritizing them by risk, and using trusted external sources to verify and enrich the information. Finding new vulnerabilities ensures you stay current with emerging threats. Assigning a risk ranking, including high or critical, helps you focus remediation where it reduces the most risk and aligns with available resources. Relying on reputable outside sources—such as vendor advisories, CERT/CC, and standardized vulnerability feeds—keeps information accurate and up to date and provides practical guidance on impact and fixes. Because each element supports timely, targeted, and credible remediation, all of these aspects should be included.