A risk assessment must identify which elements?

A risk assessment must identify which elements?

• A. User permissions and access control lists
• B. Critical assets, threats, and vulnerabilities
• C. Network topology and firewall rules
• D. Compliance gaps with no risk analysis

Answer: (B)

The main idea here is that a risk assessment starts by pinning down what you’re protecting, what could harm it, and where weaknesses could be exploited. So you identify critical assets (data, systems, processes), potential threats (events that could cause harm), and vulnerabilities (weak points that could be exploited). When you know these three pieces, you can estimate overall risk and prioritize which controls to implement. Why this is the best fit: without stating assets, threats, and vulnerabilities, you don’t have a basis to judge risk or decide where to apply safeguards. The other items describe specific controls or the environment, not the essential inputs to risk assessment itself.

The main idea here is that a risk assessment starts by pinning down what you’re protecting, what could harm it, and where weaknesses could be exploited. So you identify critical assets (data, systems, processes), potential threats (events that could cause harm), and vulnerabilities (weak points that could be exploited). When you know these three pieces, you can estimate overall risk and prioritize which controls to implement.

Why this is the best fit: without stating assets, threats, and vulnerabilities, you don’t have a basis to judge risk or decide where to apply safeguards. The other items describe specific controls or the environment, not the essential inputs to risk assessment itself.