RA Step 2 Task 1 focuses on identifying threat sources of concern, including which attributes?

• A. Capability, intent, and targeting
• B. Information sources
• C. Vulnerabilities
• D. Impacts

Answer: (A)

When identifying threat sources of concern, three attributes are essential: what the threat actor can do (capability), why they would do it (intent), and who or what they are likely to target (targeting). These pieces together describe the threat’s potential behavior and the assets at risk. Capabilities tell you the tools, resources, and access the attacker already has or could obtain. Intent reveals motivation and willingness to act, which helps distinguish deliberate threats from random or opportunistic actions. Targeting indicates which systems, data, or operations the attacker would most likely aim at. Combining these factors helps you gauge risk: a threat with strong capability and clear intent directed at high-value targets poses a greater risk and drives stronger defensive measures, monitoring, and controls.

For example, a well-funded adversary with a motive to steal sensitive customer data and targeting the database containing that data represents a high-risk threat that requires robust access controls and data protection. Other aspects like information sources, vulnerabilities, or impacts describe different parts of risk assessment and do not define the threat source’s attributes.