After risks are identified they are evaluated by which factors?

• A. Frequency and severity
• B. Cost and impact
• C. Frequency and security
• D. Severity and probability

Answer: (C)

Evaluating risks relies on two dimensions: how often the risk could occur and how severe the consequences would be. This lets you rank risks on a matrix and decide where to focus controls. Frequency expresses the likelihood of occurrence, and severity describes the magnitude of impact if it happens. Together, they give a practical way to judge priority and determine mitigations. The option that pairs frequency with severity fits this approach because it explicitly covers both how often a risk may occur and how bad the outcome could be. The other pairings don’t measure those two core factors: cost relates to financial effect rather than likelihood, and security isn’t a standard measure of risk magnitude. While some models use probability instead of frequency, the essential idea remains: assess how likely the risk is and how severe its impact would be, and use that to guide prioritization.