CBAP · Question #119
Which of the following processes can start with the source of problems or with the problem itself?
The correct answer is D. Risk identification. Risk identification is the only risk process that can begin either from known risk sources or from the problem or event itself, giving it a dual entry point not shared by other risk processes.
Question
Which of the following processes can start with the source of problems or with the problem itself?
Options
- ARisk estimation
- BRisk analysis
- CRisk management
- DRisk identification
How the community answered
(39 responses)- A3% (1)
- B10% (4)
- C3% (1)
- D85% (33)
Why each option
Risk identification is the only risk process that can begin either from known risk sources or from the problem or event itself, giving it a dual entry point not shared by other risk processes.
Risk estimation involves quantifying the probability and impact of already-identified risks, so it depends on risk identification outputs before it can begin.
Risk analysis evaluates identified risks in detail to understand their nature and magnitude, but it cannot initiate the process because it requires risk identification to have occurred first.
Risk management is the overarching framework that coordinates all risk activities and does not itself start from sources or problems - it governs the sub-processes that do.
Risk identification is explicitly designed to discover risks from two directions - starting from the source of potential problems (threat sources, hazards) or starting from the problem or event itself (potential consequences). This dual entry point allows analysts to work both proactively from causes and reactively from observed issues, making it the only risk process with this characteristic.
Concept tested: Risk identification starting points in risk management
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.