Which two internal sources does SP 800-30 name as providing insight into both threats and vulnerabilities? Choose two.

Answer: C. Incident reports
B. Trouble tickets and monitoring results

SP 800-30 draws on the organisation's own records — earlier assessments, incidents, security logs, trouble tickets and monitoring output — as evidence of both what threatens and what is weak.

Source: NIST SP 800-30 Rev. 1 (NIST) — Task 1-4 Identify Information Sources