RA Step 2 Task 6 determines risk by combining which two elements?

• A. The impact that would result and the likelihood of occurrence.
• B. The cost and schedule of mitigation.
• C. The number of users and data volume.
• D. The data format and storage location.

Answer: (A)

In risk assessment, the key idea is that risk is determined by two factors: the potential impact if the risk materializes, and the likelihood that it will occur. RA Step 2 Task 6 uses these two elements together to gauge overall risk. The impact describes how severe the consequences would be—such as data loss, service disruption, or regulatory penalties—while the likelihood assesses how probable it is that the threat could exploit a vulnerability under current controls. When you combine these, you can prioritize which risks need attention: a high-impact event that’s likely to happen represents a high risk; a high-impact event that’s unlikely to occur might be a lower risk, and a low-impact event with high likelihood might also require mitigation depending on context.

The other options don’t fit this concept. The cost and schedule of mitigation are project-management considerations, not the actual risk level. The number of users and data volume describe exposure factors but don’t directly define the likelihood and impact of a threat. The data format and storage location are technical details about data handling and do not by themselves establish risk magnitude.