At an agency, the team interviews system owners, lists weaknesses, and rates those weaknesses before anyone buys a tool. What is that activity called?
Select an answer to reveal the explanation.
Short Explanation
Measuring the house comes before any new lock is purchased. You are watching a risk assessment: owners are interviewed, weaknesses are listed, and they are rated before a tool is bought. The trap is calling that work an exploit, a playbook, or the later step of reducing risk.
Full Explanation
A risk assessment identifies what matters, lists weaknesses, and rates them so leaders can decide what to do next. The agency team is still in that step: interviews, a weakness list, and ratings, and nobody has bought a tool yet. The term is A risk assessment that lists weaknesses and rates them before any purchase. Assessment produces the rating. It does not itself install a control. Risk reduction, the later step of putting a chosen control in place after the rating is what may follow once a decision is made, and the scenario stops before that purchase. An exploit, as if interviewing owners and rating weaknesses produced attack code confuses a management activity with code that uses a vulnerability. A SOAR playbook, as if those interviews were already an automated response workflow confuses a human rating exercise with automation that runs after an alert. Exam caveat: risk assessment, risk reduction, and an exploit are different ideas, and buying a tool is not what defines the assessment. Operational check: look for an owner interview, a weakness list, and a rating, and confirm no control has been selected yet if the work is still the assessment.