What question is answered by the risk analysis component of security policy development?

What question is answered by the risk analysis component of security policy development?

• What is the cost versus benefit analysis of implementing various security technologies?
• What are the reliable, well-understood, and recommended security practices that similar organizations currently employ?
• What are the current procedures for incident response, monitoring, maintenance, and auditing of the system for compliance?
• What are the most likely types of threats given the purpose of the organization?

Exam with this question: CCNA Security Final Exam (CCNAS v1.2)