A security analyst is studying Risk and policy. Which statement about Risk is correct?

A. is never affected by controls B. is only the number of routers in a network C. combines the likelihood of a threat exploiting a vulnerability with the resulting impact D. is identical to bandwidth