Which purpose of a security risk assessment is true?

The primary purpose of a security risk assessment is to systematically examine systems, configurations, and processes to uncover implementation flaws - such as misconfigurations, missing patches, or weak controls - that could introduce exploitable vulnerabilities, enabling the organization to remediate them proactively.

Notifying customers of discovered vulnerabilities is a disclosure or remediation step that occurs after the assessment is complete, not the assessment's defining purpose.

Assigning a Security Impact Rating (SIR) value is part of the vulnerability scoring or triage process performed during vulnerability management, not the purpose of a risk assessment.

Scoring a vulnerability using frameworks like CVSS is a vulnerability management activity performed after discovery, not the objective of conducting a risk assessment.