Practise the language of prioritising security fixes: severity vs exploitability, quick wins, risk acceptance, and remediation timelines.
0 / 10 completed
1 / 10
A finding that is critical AND easy to exploit should be prioritised as ___.
High severity combined with high exploitability is the most dangerous combination and should top the remediation queue.
2 / 10
A low-effort fix that removes a real risk is often called a ___.
Quick wins (e.g. enabling a header, rotating a key) deliver disproportionate risk reduction for little effort and build momentum.
3 / 10
When leadership decides to live with a low risk rather than fix it, that's documented as risk ___.
Risk acceptance is a deliberate, documented decision by an accountable owner to tolerate a residual risk.
4 / 10
Stating 'criticals within 7 days, highs within 30' defines remediation ___.
Remediation SLAs tie severity to a deadline, making expectations concrete and trackable for the engineering team.
5 / 10
Recommending which fixes to do first based on impact and effort is a ___ exercise.
Prioritisation sequences remediation by balancing risk reduction against the cost to fix, so limited capacity is spent well.
6 / 10
During a code review of the payment service, Sarah flagged a potential SQL injection vulnerability. Mark responded with: 'It's just a minor issue; it's unlikely anyone would target this specific endpoint. Let's address it if we have time.' Which term best describes Mark's approach to remediation prioritization?
Mark's statement reflects a misunderstanding of remediation prioritization. While the *likelihood* of exploitation might be low, vulnerabilities with the potential for significant impact (like data breaches) should always be treated as high priority. Ignoring this due to low probability is a dangerous approach that could lead to serious consequences later. The goal isn't just about immediate risk, but also about preventing future problems.
7 / 10
You're in a Slack channel discussing a recently discovered bug in the user authentication module. David suggests: 'Just add a simple check to ensure the password meets minimum length requirements. Shouldn't that mitigate the problem?' What prioritization framework does David implicitly represent?
David's suggestion highlights an 'effort-driven' approach to remediation. This focuses on the simplest, quickest way to address a symptom (a weak password) without necessarily tackling the root cause of the vulnerability. While sometimes appropriate for very low-risk issues, it doesn't align with comprehensive risk mitigation strategies that consider potential impact and long-term security.
8 / 10
During a sprint retrospective, the team discussed a reported memory leak in the microservice. The product owner stated: 'We'll monitor it closely for the next two sprints and if it hasn't become critical, we won't dedicate resources to fix it.' What does this represent regarding remediation prioritization?
The product owner's statement exemplifies 'acceptable risk.' This is a valid prioritization strategy when the potential impact of the vulnerability is low and resources are limited. However, it's crucial to clearly document this decision – including the rationale, monitoring plan, and potential escalation criteria – to avoid future problems if the situation changes. Ignoring a risk simply because it's currently 'low' can be very costly.
9 / 10
A PR description for a fix states: 'This patch addresses a potential XSS vulnerability in the user profile page. Critical remediation within 72 hours, High remediation within 30 days.' What does this define?
This defines a 'Remediation SLA' (Service Level Agreement). The statement clearly sets expectations for response times based on the severity of the vulnerability – critical requiring immediate action (72 hours) versus high needing attention within a month. SLAs are fundamental to managing risks and ensuring timely remediation efforts.
10 / 10
You're leading a team discussing how to address several reported bugs in the API. One bug involves incorrect data formatting, another is a minor performance bottleneck, and a third exposes sensitive user information. Which activity best describes the 'Impact & Effort' remediation prioritization exercise?
The 'Impact & Effort' exercise is about strategically ranking remediation tasks. It involves assessing both the potential negative consequences (impact) of each bug – like data breaches or system downtime – and the time/resources required to fix it (effort). This allows teams to focus on addressing the most critical issues first, maximizing their return on investment in security and stability.
What will I practise in "Remediation Prioritization Language"?
This module focuses on Pentest Communication — real workplace phrasing you'll use on the job. It contains 10 scenario-based multiple-choice questions with instant feedback.
Is this exercise free to use?
Yes. Every exercise on CoderSlingo, including this one, is free to use with no account or sign-up required.
How many questions does this exercise have?
This module includes 10 questions. Each one gives an immediate right/wrong result plus a full explanation of the correct phrasing.
What happens if I answer a question incorrectly?
You'll see the correct answer highlighted straight away, along with a plain-English explanation of why it's right and why the other options don't fit — mistakes are part of the learning here.
Can I retry the exercise if I want a better score?
Yes — use the 'Try again' button on the results screen to reset your score and go through the questions again. There's no limit on attempts.
Who is this Pentest Communication exercise for?
It's aimed at IT professionals with working English who want to sound more natural and precise around pentest communication — useful whether you're preparing for real conversations at work or just building confidence with the vocabulary.
Do I need an account to track my progress?
No account is needed. Your progress through the exercise is tracked locally in your browser for the current session, and you can replay the module at any time.
How is this different from reading a blog article?
This exercise is an interactive drill that tests and reinforces specific phrasing through multiple-choice questions with instant feedback, while blog articles explain concepts and vocabulary in prose. The two work well together.
Where can I find more Pentest Communication exercises?
See the Pentest Communication hub for more modules like this one, or browse the full Exercises page for other IT-English topics.
Can I complete this exercise on my phone?
Yes — every exercise on CoderSlingo is fully responsive and works on phones and tablets, so you can practise anywhere.