Which TWO of the following are key components of a risk assessment methodology?
Identifying threats is a fundamental step in risk assessment.
Why this answer
Threat identification (B) is a core component of a risk assessment methodology because it systematically catalogs potential sources of harm that could exploit vulnerabilities in the environment. Without identifying threats—such as malware, insider threats, or natural disasters—the subsequent risk analysis cannot calculate likelihood or impact. Asset inventory (E) is equally fundamental because risk is always assessed in the context of what is valuable or critical to the organization; you cannot evaluate risk to assets you do not know exist.
Exam trap
CompTIA CASP+ often tests the distinction between proactive risk assessment components (threat identification, asset inventory) and reactive operational processes (disaster recovery, incident response), expecting candidates to recognize that risk appetite is a governance policy input, not a step in the methodology.