Which sequence correctly outlines the steps of a basic risk assessment?

• A. Define scope; perform penetration test; report findings; remove compromised systems.
• B. Identify assets and threats, assess vulnerabilities and impacts, determine likelihood and risk level, select and implement controls, monitor and reassess regularly.
• C. Develop security policy; train staff; deploy firewalls; monitor logs.
• D. Identify users; assign roles; enforce MFA; review annually.

Answer: (B)

Understanding risk assessment means following a lifecycle that starts with identifying what you need to protect and the threats facing it. Then you evaluate weaknesses and the potential impact if those threats materialize. Next you estimate how likely each risk is and what level of risk it represents, so you can decide on appropriate controls to reduce that risk. Finally, you monitor the environment and reassess regularly as conditions change. The sequence that lists identifying assets and threats, assessing vulnerabilities and impacts, determining likelihood and risk level, selecting and implementing controls, and ongoing monitoring and reassessment matches this lifecycle exactly, making it the best fit. Other options describe activities focused on testing and remediation, policy and training with basic controls, or identity and access management rather than the full risk assessment process.