Attacks using multiple methods to spread should be classified:

A. each time the exposure is experienced B. depending on the method used to spread C. at the highest potential level of business impact D. using multiple classifications for each impact

Correct Answer: C???? or D??????

_____________________

Note

The official answer is "C. at the highest potential level of business impact" (but it could also be wrong because it is not certified by ISACA) Other experts claim that the correct answer is: "D. using multiple classifications for each impact"

Your expert opinion (and explanation) is strongly requested. Many thanks in advance.

Many thanks!