Which element contributes most to reducing vulnerabilities in a security posture?

Which element contributes most to reducing vulnerabilities in a security posture?

• A. The number of cameras installed.
• B. Protective measures and policies to reduce vulnerabilities.
• C. The color of the building paint.
• D. The size of the training budget.

Answer: (B)

Reducing vulnerabilities comes from putting in place security controls and governance that address weaknesses across people, processes, and technology. Protective measures and formal policies establish how systems should be secured, how risks are managed, and how threats are detected and responded to. They create a consistent defense—through things like access control, patch management, secure configuration baselines, and incident response planning—that directly lowers the opportunities attackers have to exploit weaknesses, thereby reducing overall risk. The other options don’t have the same impact. Cameras help with detection and deterrence but don’t remove vulnerabilities in systems or processes. The color of the building paint has no effect on security. The size of the training budget matters, but without concrete protective measures and policies to guide security practices, money alone won’t reduce vulnerabilities as effectively.

Reducing vulnerabilities comes from putting in place security controls and governance that address weaknesses across people, processes, and technology. Protective measures and formal policies establish how systems should be secured, how risks are managed, and how threats are detected and responded to. They create a consistent defense—through things like access control, patch management, secure configuration baselines, and incident response planning—that directly lowers the opportunities attackers have to exploit weaknesses, thereby reducing overall risk.

The other options don’t have the same impact. Cameras help with detection and deterrence but don’t remove vulnerabilities in systems or processes. The color of the building paint has no effect on security. The size of the training budget matters, but without concrete protective measures and policies to guide security practices, money alone won’t reduce vulnerabilities as effectively.