Which of the following best describes "threat modeling?"

Question $48$ options:

Using an attack tree to identify possible vulnerabilities.

Connecting an existing vulnerability to a feasible attack and a threat capable of executing that attack.

Connecting risks with threats to calculate loss expectancies.

Using reduction analysis to identify the most likely vulnerabilities.