Risk Management and Threat Assessment
What to know
This domain tests whether you can move from raw threat data to defensible risk decisions. Understand the risk equation: risk as a function of likelihood and impact, with inherent risk before controls and residual risk after. Know qualitative scales versus quantitative approaches (FAIR-style loss modeling, annualized loss expectancy) and when each is appropriate. Be able to distinguish threat, vulnerability, likelihood, and impact and to identify which element a control actually changes.
Threat assessment concepts: threat actors and motivation, capability, and intent; attack surface; threat intelligence tiers (strategic, operational, tactical, technical) and the intelligence cycle. Know threat modeling methods by shape: STRIDE for categorizing threats, attack trees for goal decomposition, kill-chain and MITRE ATT&CK for adversary behavior mapping. Understand vulnerability management lifecycle: discover, prioritize, remediate, verify, and accept, with prioritization driven by exploitability and business context, not raw CVSS alone. Know risk treatment options: mitigate, transfer, avoid, accept, and how control types map (preventive, detective, corrective, compensating).
Traps
- Equating a high CVSS score with high business risk; context and exposure matter.
- Confusing a vulnerability (weakness) with a threat (actor or event).
- Believing risk transfer eliminates risk; reputational and regulatory exposure usually remains.
- Selecting a threat model by name without matching it to the question's goal.
Worked example / rule of thumb
An internet-facing VPN has a critical flaw, but no known exploitation and strong segmentation. Correct reasoning: high technical severity, moderate likelihood due to compensating controls, so prioritize by exposure and business criticality. Rule of thumb: a control changes likelihood or impact, never the threat itself.