Threat analysis versus threat assessment: which statement is correct?

• A. Threat analysis examines threat sources against vulnerabilities; threat assessment describes and evaluates threats.
• B. Threat analysis and threat assessment are the same thing.
• C. Threat analysis focuses only on physical threats.
• D. Threat analysis is for compliance audits.

Answer: (A)

The key idea here is understanding how threat analysis and threat assessment differ and how they fit into risk management. Threat analysis is the step that identifies possible threat sources—who could threaten the system, what capabilities they have, and how those threats might exploit weaknesses in assets and controls. It’s about mapping threats to the system’s vulnerabilities and understanding potential attack paths or adverse events.

Threat assessment takes that information and adds evaluation: describing the threats in terms of likelihood and potential impact, assessing the level of risk to the organization, and prioritizing which threats to address. It’s the process that turns identified threats into a risk picture and guides decisions on mitigations and controls.

So the statement aligns with these ideas: analyzing threats involves looking at threat sources relative to vulnerabilities, while assessing threats involves describing and evaluating them to determine risk and priorities. The other options don’t fit because they either equate the two processes, overly limit threat analysis to physical threats, or cast the work as primarily for compliance audits.