Describe Risk Assessment. NIST-CYBERSECURITY-FRAMEWORK-2 Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which of the following is the correct sequence of steps in a typical risk assessment process?

   • AIdentify vulnerabilities, evaluate and prioritize risks, then analyze threats
   • BEvaluate and prioritize risks, identify threats, then analyze vulnerabilities
   • CAnalyze likelihood and impact, identify threats, then evaluate and prioritize risks
   • DIdentify threats and vulnerabilities, analyze likelihood and impact, evaluate and prioritize risks
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   During a risk assessment, what is the primary purpose of identifying threats and vulnerabilities?

   • ATo assign blame for past security incidents
   • BTo determine the exact cost of every potential security control
   • CTo understand what could cause harm and where the organization is susceptible
   • DTo create a list of all employees who have access to sensitive data
   Reveal Solution Discussion Select an answer first