Which of the following is not typically considered a core component of a risk assessment?

Which of the following is not typically considered a core component of a risk assessment?

• A. Asset inventory
• B. Patch deployment frequency
• C. Threat modeling
• D. Risk computation process

Answer: (B)

Risk assessments focus on understanding what could be harmed, how it could be compromised, and how likely those events are so you can prioritize actions. The essential pieces are knowing what assets exist (asset inventory) to scope the assessment, modeling threats to identify potential attackers and attack paths, and establishing a risk computation process that combines likelihood and impact to produce risk levels. Patch deployment frequency fits under vulnerability management and risk treatment: it’s a remediation control used to reduce risk by applying fixes, rather than a step used to identify and quantify risk itself. So while patching can influence risk, it is not typically part of the assessment process.

Risk assessments focus on understanding what could be harmed, how it could be compromised, and how likely those events are so you can prioritize actions. The essential pieces are knowing what assets exist (asset inventory) to scope the assessment, modeling threats to identify potential attackers and attack paths, and establishing a risk computation process that combines likelihood and impact to produce risk levels.

Patch deployment frequency fits under vulnerability management and risk treatment: it’s a remediation control used to reduce risk by applying fixes, rather than a step used to identify and quantify risk itself. So while patching can influence risk, it is not typically part of the assessment process.