The Risk Framework can be enriched through the Assets & Identities Framework, Risk Factoring, and Annotations , making option A the correct combination.
The Assets & Identities Framework contributes organizational context about entities represented by risk objects. For example, a destination system may be identified as highly critical, or a user may belong to a privileged identity category. That context allows the same underlying behavior to be interpreted differently depending on the entity involved.
Risk Factors provide a mechanism for modifying risk according to contextual conditions. A detection may assign a baseline risk score, while a Risk Factor increases or otherwise adjusts the effective risk when characteristics of the affected user or asset justify higher concern.
Annotations provide structured metadata describing the detection and its security meaning, such as mappings to relevant adversary techniques or other analytical context. This makes accumulated risk more understandable and useful to analysts.
A risk object is the entity receiving risk rather than an enrichment mechanism. Data models provide normalized data structures, and the notable framework concerns analyst-facing security events rather than the complete enrichment set requested here.
Study Guide topics: Risk Framework; Assets & Identities; Risk Factors; annotations; contextual enrichment; risk objects; RBA.
