Which statement about risk analysis is true?

• A. It identifies threats and assets.
• B. It quantifies loss exposures and the frequencies and costs of occurrence.
• C. It is a mandatory requirement of PCI DSS.
• D. It eliminates the need for risk assessment.

Answer: (B)

Risk analysis is about putting numbers to risk so you can prioritize what to protect. The key is quantification: estimating how often a threat could occur (frequency) and what the resulting impact would be (loss exposure and costs). This numeric view lets you compare different risks and decide where to invest in controls.

Identifying threats and assets is part of the overall risk process, but risk analysis specifically adds measurement and prioritization through quantified estimates, not just listing what could go wrong. Saying risk analysis is a mandatory PCI DSS requirement overstates the wording, and saying it eliminates the need for risk assessment is simply false—the process is needed, but it isn’t about erasing the assessment itself.