ISC2 Certified Cloud Security Professional (CCSP) Practice Question

NIST SP 800-30 breaks risk into two fundamental factors: the likelihood that a given threat will exploit a vulnerability and the magnitude of the resulting impact. In the scenario, the team has already identified the threat, vulnerability, and existing controls; they are now estimating how probable it is that the threat will actually occur. That estimate maps directly to the likelihood component. Impact, residual risk, and risk tolerance are different concepts: impact measures consequences, residual risk is what remains after controls, and tolerance is management's appetite for risk.