Which of the following is a component of a risk assessment?

Administrative safeguards - such as security policies, workforce training, and assigned security responsibilities - are a formal component of risk assessments under NIST SP 800-30 and the HIPAA Security Rule. During a risk assessment, existing administrative controls are evaluated to determine their effectiveness and gaps are identified as part of calculating residual risk.

Physical security is a category of controls that may be reviewed or recommended as an output of a risk assessment, but it is a control domain rather than a component of the assessment process itself.

Logical interface is a networking or software abstraction concept and is not a recognized phase or component in formal risk assessment methodologies.

A DMZ is a network architecture control used to segment untrusted traffic and is an implementation artifact, not a component of the risk assessment process.