In penetration testing, what does prioritizing high-value assets mean?

• A. HVAs are optional targets.
• B. HVAs are only for regulatory compliance.
• C. HVAs are systems or data critical to operation and should be prioritized.
• D. HVAs are irrelevant to the test scope.

Answer: (C)

Prioritizing high-value assets means focusing testing efforts on the systems and data whose compromise would have the biggest impact on the business. In a pen test, you assess risk by considering how critical an asset is to operations, how sensitive the data it handles is, and how exposed it is. Because resources are limited, you allocate more time and deeper testing to those assets to uncover the most significant weaknesses and ensure they are protected first. High-value assets are typically core systems, databases with sensitive data, or infrastructure like authentication services and payment processors—the ones whose compromise would disrupt operations or cause major data loss.

These assets aren’t optional targets, they’re the focus because they carry the greatest risk. They aren’t just for regulatory compliance, even though regs may require protecting them, and they aren’t irrelevant to the test scope; they largely define what the test aims to protect and verify.