Exam CRISC topic 1 question 1622 discussion

sorry for confusion i think its D. BIA identifies what is critical, making it possible to know which threats matter most , VA identifies weaknesses, but doesn’t assess business relevance or impact, and PT Focuses on technical weaknesses, not on the relevance or impact of threats on business processes

B. Vulnerability Assessment identify weakness in the system, then map them with relevant threat actor to expose them. PT is done after VA to validate , can someone get in?

A vulnerability assessment is the most effective process to determine the relevance of threats for specific risk scenarios because it: Identifies weaknesses or exposures in systems, applications, or processes. Helps correlate which threats are actually applicable based on known vulnerabilities. Enables risk practitioners to prioritize risk scenarios based on realistic threat vectors. By understanding the organization’s vulnerabilities, practitioners can determine which threats are relevant and likely to be exploited, making the risk scenario more accurate and actionable.

I think A is the most correct answer, reason being that threats exploits vulnerabilities so unless a threat exploits a vulnerability a risk event would not occur.

Vulnerability Assessment is the answer. A