When applying the Top Threats Analysis methodology following an incident, what is the scope of the technical impact identification step?

Question

Options

• ADetermine the impact on the controls that were selected by the organization to respond to
• BDetermine the impact on confidentiality, integrity and availability of the information system.
• CDetermine the impact on the financial, operational, compliance and reputation of the organization.
• DDetermine the impact on the physical and environmental security of the organization, excluding

• A
  9% (4)
• B
  7% (3)
• C
  2% (1)
• D
  82% (36)

Explanation

Option D is correct because in the Top Threats Analysis methodology, the technical impact identification step specifically scopes to physical and environmental security - the tangible, infrastructure-level consequences of an incident on facilities, hardware, and physical access controls (with certain exclusions noted in the full option text).

Option B (CIA triad - confidentiality, integrity, availability) describes a business information impact assessment, not the technical impact step; CIA analysis belongs to a different phase of the methodology. Option C (financial, operational, compliance, reputational harm) represents business impact, which is a separate, higher-level analysis step that follows technical assessment. Option A (impact on selected controls) describes a control evaluation step, not the technical impact identification phase.

Memory tip: Think "Tech = Tangible" - the technical impact step in Top Threats Analysis looks at the physical/environmental layer (the stuff you can touch and see), while CIA and business risk belong to later, more abstract impact steps.

Note for exam takers: Option D appears to be truncated in this version of the question ("excluding..."). Make sure you review the full option text in your source material, as the exclusion clause is likely significant for understanding the precise scope.

No community discussion yet for this question.