Questão 28 — CompTIA SY0-701 CompTIA Security+ Certification Exam

Explanation: Correct answer: B. The overall organizational risk tolerance Organizational risk tolerance is the primary factor determining how quickly and aggressively vulnerabilities should be remediated. Security+ SY0-701 explains that organizations have different appetites for risk depending on business needs, regulatory expectations, operational constraints, and financial impact. A company with low risk tolerance may prioritize almost every vulnerability and remediate quickly. A company with high risk tolerance may delay or accept some lower- impact risks. This consideration directly influences patch prioritization, resource allocation, and mitigation timelines. Option A---executive reporting---does not influence technical prioritization. Option C---open- source intelligence---helps identify vulnerabilities but does not determine urgency. Option D---the source of the reported risk---is irrelevant; what matters is severity and business impact. Thus, B: The overall organizational risk tolerance is the key factor for prioritizing remediation. Why the other options are incorrect: A. --executive reporting---does not influence technical prioritization. C. --open-source intelligence---helps identify vulnerabilities but does not determine urgency. D. --the source of the reported risk---is irrelevant; what matters is severity and business impact. Thus, B: The overall organizational risk tolerance is the key factor for prioritizing remediation.