Which of the following are the initial steps required to perform a risk analysis process? Each correct answer represents a part of the solution. Choose three.

Question

Options

• AEstimate the potential losses to assets by determining their value.
• BEstablish the threats likelihood and regularity.
• CValuations of the critical assets in hard costs.
• DEvaluate potential threats to the assets.

• A
  75% (21)
• C
  25% (7)

Explanation

Risk analysis begins with three foundational activities: identifying what you're protecting (A), understanding how often threats may occur (B), and identifying what could harm those assets (D). Together, these steps form the discovery phase before you can calculate actual risk levels or implement controls.

• A is correct - Estimating potential losses by determining asset value establishes the baseline for measuring risk impact.
• B is correct - Assessing threat likelihood and regularity tells you how probable a threat is, which directly feeds into risk scoring.
• D is correct - Evaluating potential threats identifies what could harm your assets, a prerequisite to everything else.
• C is wrong - "Valuations of critical assets in hard costs" is a narrower subset of A; it limits valuation to tangible monetary costs only, ignoring intangible losses (reputation, downtime). It's not a distinct initial step - it's partially covered by A and less complete.

Memory tip: Think "Value, Threat, Likelihood" - VTL. You must know what something is worth, what could threaten it, and how likely that threat is before any further analysis is possible.

No community discussion yet for this question.