Based on the MGM Resorts and Change Healthcare breach examples, what key distinction does the course draw between the value of conducting a cybersecurity risk assessment and what an assessment can guarantee regarding security breaches?

### Why this is right A strong answer uses the specific facts provided for each incident and connects them to the stated lesson about unassessed vulnerabilities. It avoids claiming that either breach would certainly have been prevented by an assessment, because the course material does not make that claim. ### The concept Breach examples can help explain why assessment matters by showing the kinds of harm an organization may face. MGM Resorts illustrates operational disruption associated with social engineering, with hotel and casino systems affected. Change Healthcare illustrates impact on healthcare operations and sensitive data exposure, with 197 million records reported. The general conclusion is that assessment can help identify assets, threats, vulnerabilities, and risks before they contribute to harm. A case example is evidence of a possible consequence, not proof that one specific safeguard would have prevented it. ### What a good answer covers - The MGM Resorts attack type and operational impact. - The Change Healthcare operational impact and reported data exposure. - The course lesson about vulnerabilities that were not properly assessed. - A careful distinction between supporting assessment and guaranteeing prevention. ### Terms - **Breach**: A security incident involving unauthorized access, exposure, or disruption. - **Asset**: Something of value to an organization that may need protection. ### Remember Use incident details to illustrate risk, but do not claim the material proves a breach was preventable.