The library board wants a one-line risk definition the civic SOC can reuse when reviewing malware notables. Which definition should the analyst give?
Select an answer to reveal the explanation.
Short Explanation
Think of risk like a storm hitting a leaky roof over a rare book room—you need a storm (threat), a leak (vulnerability), and something that actually matters if it gets wet (impact or likelihood). A lone malware notable is just weather on the radar, not the whole risk equation.
Full Explanation
When the library board wants a reusable one-line risk definition for reviewing malware notables, the analyst should say risk is a function of threat, vulnerability, and impact or likelihood. Civic risk language must keep all three ideas visible: a storm (threat), a leak (vulnerability), and something that matters if it gets wet (impact or likelihood). A lone malware notable in Enterprise Security is a signal, not the entire risk equation for library operations.
Saying any malware notable is automatically high risk fails by concept: notables are alerts, not completed risk assessments. Saying risk equals the overnight count of correlation searches fails by concept: volume of firings is not the threat-vulnerability-impact function. Saying risk is only replacement cost of catalog servers fails by concept: cost is one impact factor, not the full definition that also includes threat and vulnerability.
Exam caveat: SPLK-5001 risk definitions expect the classic function of threat, vulnerability, and impact/likelihood—not alert counts or single cost figures.
Operational check: Add the three-part definition to the library SOC risk glossary, and when reviewing malware notables require Analysts to note threat actor/tooling, vulnerable condition, and civic impact before labeling priority.