A risk assessment is used to determine if a known or foreseeable threat exists.

• A. Hazard
• B. Threat
• C. Risk
• D. Vulnerability

Answer: (C)

The main idea here is that risk assessment looks at whether harm could occur by considering a threat in combination with weaknesses that could be exploited and the potential impact. Risk is the concept that brings all that together—the likelihood that a known or foreseeable threat could exploit a vulnerability and the consequence if it happens. A hazard is simply something in the environment that could cause harm, not specifically tied to a threat or to the likelihood and impact of an event. A threat refers to the source or actor that could cause harm, but by itself it doesn’t account for whether there’s a weakness to be exploited or how severe the outcome would be. A vulnerability is the weakness that could be exploited, but on its own it doesn’t indicate that harm is likely or how serious it would be. So the term that best fits the purpose of a risk assessment—determining if there is a real risk from a known or foreseeable threat—is risk.