Select ALL factors the material identifies as relevant to risk-based vulnerability prioritization.

### Why this is right - **Active exploitation** raises urgency because attackers are already using the weakness. - **Internet exposure** can increase the number of potential attackers able to reach the asset. - **Asset or service criticality** reflects the operational consequences of compromise. - **Data sensitivity** affects the confidentiality impact of exploitation. ### The concept Prioritization directs limited remediation effort toward the most consequential weaknesses. The course also names privileges, operational dependency, and compensating controls as relevant considerations. A raw scan score or finding count may be useful, but it should not replace organizational context. A weakness on a critical public-facing service may deserve attention before numerous lower-impact findings on isolated systems. ### The other options - **Whether the finding has the shortest title**: Title length has no meaningful relationship to exploitability or business impact. ### Terms - **Internet exposure**: Whether a system or service can be reached from the public internet. - **Compensating control**: A safeguard that reduces risk when direct remediation is delayed or unavailable. ### Remember Prioritize by exploitability and business consequences, not by superficial properties of a scan report.