What is the primary objective of risk assessment in DSAC-11 Annex B?

• A. To identify and evaluate security risks to information assets and determine appropriate mitigations and controls.
• B. To monitor network traffic for anomalies.
• C. To classify all data by sensitivity levels.
• D. To deploy all possible security controls.

Answer: (A)

Identifying and evaluating security risks to information assets and determining appropriate mitigations and controls is what risk assessment aims to achieve. It involves cataloging assets, recognizing threats and vulnerabilities, estimating the potential impact and likelihood, and then rating overall risk to prioritize what protections are most needed. The purpose is to decide which controls to implement to reduce risk to an acceptable level and to allocate resources effectively.

What about the other options? Monitoring network traffic for anomalies fits more with security operations and detection, not the broad process of understanding risk and choosing mitigations. Classifying data by sensitivity concerns labeling and handling policies, not assessing risk to assets. Deploying all possible security controls sounds appealing but isn’t practical; risk management focuses on selecting a balanced, effective set of controls based on cost, feasibility, and the level of risk.