A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?

A company recently completed an internal audit and discovered that there is CSRF vulnerability in 20 of its hosted applications. Based on the audit, which recommendation should an engineer make for patching?
A . Identify the business applications running on the assets
B . Update software to patch third-party software
C . Validate CSRF by executing exploits within Metasploit
D . Fix applications according to the risk scores

Answer: D