ITPEC IP October 2022 Question 45
ITPEC IP October 2022 — Question 45 of 100
Risk identification is performed first. The organization identifies relevant assets, threats, vulnerabilities, events, causes, and potential consequences. It can then analyze likelihood and impact, evaluate priorities against criteria, and select treatments.
Answer (b)
Why not others:
- analysis requires risks to have already been identified
- evaluation compares analyzed risks with acceptance criteria
- treatment follows assessment and chooses how to modify or accept risk
Key rule: The sequence is identify, analyze, evaluate, then treat.
AI-generated — may contain errors
The original exam layout is preserved in the image so diagrams, formulas, tables, and code remain accurate.
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official IP past-paper collection or Report an issue.