Which term determines a qualitative or quantitative estimate of risk related to a well-defined situation and a recognized threat?

Which term determines a qualitative or quantitative estimate of risk related to a well-defined situation and a recognized threat?

• A. Process
• B. Shared Responsibility Model
• C. Inherited Controls
• D. Risk Assessment/Risk Analysis (RA)

Answer: (D)

Risk assessment is the process of estimating risk by evaluating how likely a threat is to exploit a vulnerability in a defined situation and what the impact would be. This can be done qualitatively (like high/medium/low) or quantitatively with numeric scores. In this scenario, the focus is on producing a structured estimate of risk for a well-defined context against a recognized threat, which is exactly what risk assessment provides, so it’s the best fit. The other terms aren’t about estimating risk: a process is a broad activity that could refer to many things; the Shared Responsibility Model describes who is responsible for security duties in cloud environments; inherited controls refer to controls that come from external sources rather than being assessed or calculated in the given context.

Risk assessment is the process of estimating risk by evaluating how likely a threat is to exploit a vulnerability in a defined situation and what the impact would be. This can be done qualitatively (like high/medium/low) or quantitatively with numeric scores. In this scenario, the focus is on producing a structured estimate of risk for a well-defined context against a recognized threat, which is exactly what risk assessment provides, so it’s the best fit.

The other terms aren’t about estimating risk: a process is a broad activity that could refer to many things; the Shared Responsibility Model describes who is responsible for security duties in cloud environments; inherited controls refer to controls that come from external sources rather than being assessed or calculated in the given context.