Public Exposure Check: Which statement describes it?

• A. Generating incident reports
• B. Assessing what information is publicly available about the organization and whether it could be exploited
• C. Verifying internal access controls
• D. Configuring firewall rules

Answer: (B)

Public Exposure Check is about identifying what information about the organization is exposed to the public and whether that exposure could be exploited by attackers. It involves examining publicly available data—like website content, social media, public repositories, and other open sources—and evaluating how that information could help an attacker, such as revealing sensitive details, configurations, or credentials. The goal is to understand and reduce risk from what is openly accessible.

Generating incident reports focuses on documenting incidents after they happen, not on what the public can see about the organization. Verifying internal access controls checks who can access resources inside the organization, not what is publicly exposed. Configuring firewall rules deals with controlling network traffic at the boundary, which is a different aspect of defense than assessing public information exposure.