Which of the following statements is true regarding risk management and vulnerability management?

a. Both approaches involve processes that typically take many months or years to complete.

b. Risk management is often conducted using an IT asset-based approach.

c. They both have the objective of reducing the likelihood that detrimental events occur.

d. Vulnerability management is more complex and strategic.