A well executed risk analysis provides a great deal of useful information. A risk analysis has four main objectives. What is not one of the four main objectives of a risk analysis?

Question

Options

• AIdentifying assets and their value
• BDetermining the costs of threats
• CEstablishing a balance between the costs of an incident and the costs of a security measure
• DDetermining relevant vulnerabilities and threats

• A
  10% (5)
• B
  81% (39)
• C
  4% (2)
• D
  4% (2)

Explanation

"Determining the costs of threats" is not one of the four main objectives because risk analysis focuses on identifying and evaluating risks - not on calculating the monetary cost of threats themselves (that falls under cost-benefit analysis or business impact analysis, which are separate activities).

The distractors are all genuine objectives: A (identifying assets and their value) is foundational - you can't protect what you don't know you have; C (balancing incident costs vs. security measure costs) is the core justification for any security investment; and D (identifying vulnerabilities and threats) is the primary analytical step that drives the entire process.

Memory tip: Think of risk analysis with the acronym AVID - Assets, Vulnerabilities, Impact (of incidents vs. controls), Decisions about risk treatment. "Costs of threats" sounds plausible but conflates threat identification with financial modeling, which is a distractor designed to trip up test-takers who confuse risk analysis with cost analysis.

No community discussion yet for this question.