Which statement about risk modeling is accurate?

Which statement about risk modeling is accurate?

• A. Risk is unrelated to threat
• B. Risk is determined solely by vulnerability
• C. Risk is a function of threat, vulnerability, and impact
• D. Risk cannot be quantified

Answer: (C)

Risk modeling looks at how likely a threat is to exploit a vulnerability and what the resulting consequences would be. The accurate statement says risk is a function of threat, vulnerability, and impact. Each piece matters: a credible threat raises the chance something could happen; a vulnerability is the weakness that could be exploited; impact captures the potential loss or damage if exploitation occurs. When you multiply or combine these factors, you get a risk level that can be analyzed or quantified. Consider that risk isn’t unrelated to threat—without a threat, even a highly vulnerable system may not incur risk. It also isn’t determined solely by vulnerability—there may be little threat or limited impact, reducing overall risk. And yes, risk can be quantified by assigning values to likelihood, vulnerability, and impact and computing a risk score.

Risk modeling looks at how likely a threat is to exploit a vulnerability and what the resulting consequences would be. The accurate statement says risk is a function of threat, vulnerability, and impact. Each piece matters: a credible threat raises the chance something could happen; a vulnerability is the weakness that could be exploited; impact captures the potential loss or damage if exploitation occurs. When you multiply or combine these factors, you get a risk level that can be analyzed or quantified.

Consider that risk isn’t unrelated to threat—without a threat, even a highly vulnerable system may not incur risk. It also isn’t determined solely by vulnerability—there may be little threat or limited impact, reducing overall risk. And yes, risk can be quantified by assigning values to likelihood, vulnerability, and impact and computing a risk score.