Risk Assessment and Methodology Questions

Structured approach to defining scope and performing risk assessments using an explicit methodology such as the SALT framework. Candidates should be able to define scope and requirements, identify and classify critical assets and data, enumerate threat scenarios and attack surfaces, assess defenses across layers, reason about tradeoffs between security controls and business impact, estimate likelihood and impact to derive risk, recommend mitigations and compensating controls, and communicate residual risk and prioritization to stakeholders. The description should cover how to convert findings into remediation plans and risk metrics.