Which of the following statements is related with the second law of OPSEC?

A.
If you are not protecting it (the critical and sensitive information), the adversary wins!

B.
If you don’t know what to protect, how do you know you are protecting it?

C.
If you don’t know about your security resources you could not protect your network.

D.
If you don’t know the threat, how do you know what to protect?

Explanation:
OPSEC is also known as operations security. It has three laws.
The First Law of OPSEC. If you don’t know the threat, how do you know what to protect? Although
specific threats may vary from site to site or program to program. Employees must be aware of the
actual and postulated threats. In any given situation, there is likely to be more than one adversary,
although each may be interested in different information.
The Second Law of OPSEC. If you don’t know what to protect, how do you know you are protecting
it? The “what” is the critical and sensitive, or target, information that adversaries require to meet
their objectives.
The Third Law of OPSEC. If you are not protecting it (the critical and sensitive information), the
adversary wins! OPSEC vulnerability assessments, (referred to as “OPSEC assessments” – OA’s – or
sometimes as Surveys”) are conducted to determine whether or not critical information is vulnerable
to exploitation. An OA is a critical analysis of “what we do” and “how we do it” from the perspective
of
an adversary. Internal procedures and information sources are also reviewed to determine whether
there is an inadvertent release of sensitive information.
Answer option D is incorrect. The statement given in the option is not a valid law of OPSEC.

http.//www.guardianangelsforsoldierspet.org/index.php?option=com_content&view=article&id=70
&Itemid=153