Which item is not typically included in a risk assessment?

• A. Marketing strategy
• B. Asset valuation
• C. Threat assessment
• D. Vulnerability assessment

Answer: (A)

Risk assessment concentrates on safeguarding assets by identifying what needs protection, the threats that could harm them, and the weaknesses in defenses that could be exploited. The marketing strategy doesn’t address security risks to assets; it’s about how the organization competes and grows, which belongs to business planning rather than risk assessment. In contrast, asset valuation determines what is worth protecting, threat assessment looks at potential danger sources and how likely they are to occur, and vulnerability assessment finds weaknesses in controls or defenses. Together, these elements help prioritize what to fix first. For example, you’d value critical data and equipment, consider potential attackers or natural hazards, and check for gaps like unlocked doors or unpatched systems.