Which statement best describes a risk assessment approach?

• A. Asset discovery and remediation planning only.
• B. A random set of compliance tasks.
• C. A financial risk analysis.
• D. A systematic process to identify, quantify, and prioritize security risks; steps include asset discovery, threat modeling, vulnerability assessment, impact analysis, and remediation planning.

Answer: (D)

A risk assessment approach is a systematic process to identify, quantify, and prioritize security risks so you can focus resources where they matter most. It starts with asset discovery to know what you’re protecting, then threat modeling to map out how attackers might exploit those assets. A vulnerability assessment reveals weaknesses that could be exploited, and impact analysis estimates what would happen if a risk materializes. Remediation planning then translates all of that into concrete steps to reduce risk. This sequence ties together what to protect, how threats could reach it, where weaknesses lie, and what the consequences would be, guiding actions in a purposeful and prioritized way. The other options don’t capture this comprehensive, structured flow: one only covers a partial set of activities, relies on randomness, or focuses on a different type of risk altogether.