A qualitative risk assessment is used to identify:

a. Vulnerabilities, threats, and countermeasures

b. Vulnerabilities, threats, threat probabilities, and countermeasures

c. Assets, risks, and mitigation plans

d. Vulnerabilities and countermeasures