Drag steps to the numbered slots on the right, or tap a step then tap a slot.
Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5
CCSP Cloud Application Security Practice Question
Drag and drop the steps for conducting a cloud security risk assessment using the NIST CSF framework into the correct order.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Identification, then threat/vulnerability assessment, then risk analysis, then treatment, then monitoring
Start with identification, then threat/vulnerability assessment, risk analysis, treatment, and monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Identification, then threat/vulnerability assessment, then risk analysis, then treatment, then monitoring
Why this is correct
This is the correct order because the NIST CSF risk assessment process begins with identifying assets and risks, followed by assessing threats and vulnerabilities, analyzing the risk, implementing treatment measures, and finally monitoring for changes.
- ✗
Threat/vulnerability assessment, then identification, then risk analysis, then treatment, then monitoring
Why it's wrong here
This is incorrect because identification must come before threat/vulnerability assessment; you cannot assess threats without first identifying what you need to protect.
- ✗
Identification, then risk analysis, then threat/vulnerability assessment, then treatment, then monitoring
Why it's wrong here
This is incorrect because risk analysis depends on the threat and vulnerability assessment; you must assess threats and vulnerabilities before analyzing risk.
- ✗
Identification, then threat/vulnerability assessment, then treatment, then risk analysis, then monitoring
Why it's wrong here
This is incorrect because risk analysis must precede treatment; you cannot decide on treatment without understanding the risk level.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.