Which of the following steps for risk assessment methodology refers to vulnerability identification?

Question

Options

• ADetermines if any flaws exist in systems, policies, or procedures
• BAssigns values to risk probabilities; Impact values.
• CDetermines risk probability that vulnerability will be exploited (High. Medium, Low)
• DIdentifies sources of harm to an IT system. (Natural, Human. Environmental)

• A
  96% (25)
• B
  4% (1)

Explanation

Vulnerability Identification Explained

Option A is correct because vulnerability identification is specifically the process of examining systems, policies, and procedures to uncover weaknesses or flaws that could potentially be exploited - it's about finding the "gaps" in your defenses before attackers do.

Option B is incorrect as it describes risk analysis, the step where numerical or qualitative values are assigned to the likelihood and impact of risks occurring. Option C is wrong because determining the probability that a vulnerability will be exploited refers to likelihood determination, a separate step that comes after vulnerabilities have already been identified. Option D describes threat identification, which focuses on cataloging the sources of potential harm (e.g., hurricanes, hackers, power failures), not the weaknesses within the system itself.

Memory Tip: Think of it this way - Threats are the attackers (Option D), Vulnerabilities are the unlocked doors (Option A), and Risk Analysis assigns the price tag to the damage (Option B). If you remember the sequence "Who → What Weakness → How Likely → How Bad," you can map each step cleanly: Threat → Vulnerability → Likelihood → Impact.

No community discussion yet for this question.