Elements Required for Organizational Risk Assessment

350-201 By islever Editorial Last updated

Analyze elements of a risk analysis (combination asset, vulnerability, and threat)

Short answer

AC The asset management team needs to identify the specific assets affected by the vulnerability within the organization and determine the likelihood and severity of occurrence to conduct an accurate risk assessment.

Question

A new threat was discovered that is distributed with legitimate software across the internet. Management asked for an organizational risk assessment to understand the threat and impact. The asset management team provided a list of all the assets within the organization and an existing incident response plan. Which two elements does the asset management team need to conduct the risk assessment? (Choose two.)
  1. list of assets affected by the vulnerability within the organization Correct Answer
  2. business-critical assets and services
  3. likelihood and severity of occurrence for the vulnerability Correct Answer
  4. threat modeling and countermeasures approved by my senior management
  5. revised incident response plan for the newly discovered vulnerability

Key Takeaways

The main trap is confusing general asset lists with specific vulnerability exposure. You must isolate the relevant assets and apply the risk formula (Likelihood x Severity).

This question tests the core components of a risk assessment. The correct answers are identifying affected assets and determining likelihood/severity.

Common mistake: Candidates often choose B (business-critical assets) because they think about business impact. However, risk assessment requires the technical likelihood and severity first; criticality is used later for prioritization.

Expert Analysis

Risk Assessment Fundamentals: A risk assessment quantifies risk by evaluating two primary factors: the likelihood of a threat exploiting a vulnerability and the severity (impact) of that occurrence. The scenario provides an asset inventory but lacks the specific context needed to calculate risk for this new threat.

Identifying Affected Assets (A): The provided list includes all assets, not just those vulnerable to this specific threat. To assess risk accurately, the team must filter this list to identify only the assets affected by the vulnerability within the organization. Without this, you cannot determine the scope of the exposure.

Likelihood and Severity (C): Risk is formally calculated as a function of Likelihood and Impact (Severity). The question asks what is needed to understand the 'threat and impact.' Knowing which assets are affected is insufficient without knowing how likely the attack is and how severe the consequences would be. These two elements allow the team to prioritize and quantify the risk.

Why Other Options Are Incorrect: B: Business-criticality is important for prioritization after risk is assessed, but it is not a fundamental component of the initial risk calculation formula (Likelihood x Severity). D: Threat modeling is a proactive design activity, not a reactive assessment of a discovered external threat. Countermeasures come after assessment. E: The incident response plan is a mitigation tool, not a data point for assessing the risk itself.

Exam Strategy

When asked about risk assessment components, always look for 'Likelihood' and 'Impact/Severity'. If those are present, look for the specific scope (affected assets/vulnerabilities). Avoid options that refer to mitigation (like IR plans or countermeasures) unless the question specifically asks for remediation steps.

Frequently Asked Questions

What is the formula for calculating risk?

Risk is typically calculated as Risk = Likelihood × Impact (or Severity). This helps organizations prioritize threats based on probability and potential damage.

Why is the full asset list not enough for risk assessment?

A full asset list includes everything in the organization. Risk assessment requires narrowing down to only those assets that are actually vulnerable to the specific threat being analyzed.

More 350-201 FAQ →

Community Votes

A
50%
C
50%

50% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. Nerdx1 👍 1
    Answer is , A and C The question already says "The asset management team provided a list of all the assets within the organization and an existing incident response plan". Now from that list, need to identify the assets affected by the vulnerability and the Likelihood and severity of occurrence.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

The NIST Incident Response Step the Team Skipped: Containment

S-grade

Server Hardening Recommendations for Production Deployment

S-grade

Scoping a confirmed VPN intrusion: risk identification before containment

A-grade

← Back to 350-201 Study Guide