During a municipal risk identification workshop, finance and IT list ransomware that encrypts property-tax databases as a top concern. What is the workshop primarily accomplishing?
Select an answer to reveal the explanation.
Short Explanation
Risk identification is the sticky-note stage—name the storms that could hit the town's assets before you price umbrellas. Listing ransomware against tax systems is putting the threat on the board, not yet buying insurance or running the ALE math.
Full Explanation
Risk identification is the workshop stage where municipal stakeholders name threats, vulnerabilities, and asset exposures that matter before they quantify, treat, or transfer those risks. Listing ransomware that encrypts property-tax databases ties a concrete threat scenario to critical city revenue systems. That act places the risk on the register for later analysis; it does not yet price insurance, compute ALE for the whole city, or close residual risk with acceptance paperwork. Selecting cyber insurance limits before any risks are named inverts the process. Transfer decisions need identified scenarios and some understanding of exposure; buying coverage blindly does not constitute identification and may leave the highest-impact municipal risks underinsured or uncovered. Calculating annualized loss expectancy for every asset is a quantitative analysis activity that comes after risks and loss models are defined. Identification workshops surface what to analyze; they are not the ALE computation itself, and demanding ALE for every city asset during identification is usually premature and impractical. Closing all residual risk with a blanket acceptance memo is a treatment and governance failure. Acceptance must be risk-specific, authorized, and typically time-bounded. Identification does not finish the risk lifecycle by rubber-stamping acceptance for everything named in the room. Exam caveat: SY0-701 sequences risk management activities. Identification is naming relevant risks against assets and scenarios. Do not confuse it with analysis formulas, transfer purchases, or acceptance decisions that belong later in the process. Operational check: Capture each identified municipal risk with asset context, threat scenario, and a provisional owner in the risk register, then schedule analysis and treatment rather than jumping straight to insurance quotes or blanket acceptance.