A risk assessment is conducted to determine the probability of a security incident actually happening, and the impact and consequences of such an occurrence.

A risk assessment is conducted to determine the probability of a security incident actually happening, and the impact and consequences of such an occurrence.

• A. Severity
• B. Probability
• C. Impact
• D. Likelihood

Answer: (B)

The main idea being tested is how risk is assessed along two dimensions: how likely an event is to occur and how severe the consequences would be if it does. The stem describes determining the probability of a security incident happening, as well as its impact. The term that matches the chance aspect is probability. While likelihood is essentially the same idea, the option that aligns with the stem’s wording and the established phrasing in risk assessment is Probability. Severity describes how bad the outcome could be, and Impact refers to the consequences themselves, not the chance of occurrence.

The main idea being tested is how risk is assessed along two dimensions: how likely an event is to occur and how severe the consequences would be if it does. The stem describes determining the probability of a security incident happening, as well as its impact. The term that matches the chance aspect is probability. While likelihood is essentially the same idea, the option that aligns with the stem’s wording and the established phrasing in risk assessment is Probability. Severity describes how bad the outcome could be, and Impact refers to the consequences themselves, not the chance of occurrence.