Which one of the following is NOT one of the outcomes of a vulnerability assessment?

A.
Quantative loss assessment

B.
Qualitative loss assessment

C.
Formal approval of BCP scope and initiation document

D.
Defining critical support areas

Explanation:
Formal approval of BCP scope is not part of the vulnerability assessment. A vulnerability assessment identifies
a wide range of vulnerabilities in the environment. Vulnerability assessments just find the vulnerabilities (the
holes). A vulnerability assessment is the process of identifying, quantifying, and prioritizing (or ranking) the
vulnerabilities in a system.
Incorrect Answers:
A: Quantifying losses is part of the vulnerability assessment.
B: Prioritizing (qualifying) losses is part of the vulnerability assessment.
D: Identifying critical vulnerabilities is part of the vulnerability assessment.

https://en.wikipedia.org/wiki/Vulnerability_assessment