Which of the following lists are valid data-gathering activities associated with a risk assessment? 

Threat identification, vulnerability identification, control analysis 

Threat identification, response identification, mitigation identification 

Attack profile, defense profile, loss profile 

System profile, vulnerability identification, security determination