312-39 · Question #24
Lisa Carter, a SOC analyst at a financial services firm, is performing a risk assessment following suspicious alerts detected by the SIEM. She evaluates three key factors: the likelihood of an…
The correct answer is A. High Likelihood, High Impact, High Asset Value. The highest risk is the scenario where all contributing factors are high: likelihood, impact, and asset value. Risk is commonly treated as a function of probability and consequence; many organizations also incorporate asset value or criticality into consequence. When likelihood…
Question
Lisa Carter, a SOC analyst at a financial services firm, is performing a risk assessment following suspicious alerts detected by the SIEM. She evaluates three key factors: the likelihood of an attack succeeding based on current threat intelligence, the impact on critical business operations if the breach occurs, and the value of the assets targeted (e.g., customer data, financial systems). Using the standard risk assessment approach, which scenario represents the highest risk to the organization?
Options
- AHigh Likelihood, High Impact, High Asset Value
- BLow Likelihood, High Impact, Low Asset Value
- CLow Likelihood, Low Impact, High Asset Value
- DHigh Likelihood, Low Impact, High Asset Value
How the community answered
(12 responses)- A92% (11)
- B8% (1)
Explanation
The highest risk is the scenario where all contributing factors are high: likelihood, impact, and asset value. Risk is commonly treated as a function of probability and consequence; many organizations also incorporate asset value or criticality into consequence. When likelihood is high, the threat is more probable to materialize. When impact is high, the organization faces significant operational disruption, financial loss, and regulatory exposure. When asset value is high, the target represents highly sensitive or business-critical data/systems, which amplifies both the harm and urgency. Therefore, “High Likelihood, High Impact, High Asset Value” clearly produces the maximum risk rating. The other scenarios reduce at least one dimension: low likelihood reduces probability, low impact reduces consequence, and low asset value reduces business criticality and potential damage. In SOC practice, the highest-risk scenario drives immediate prioritization: faster containment, more aggressive monitoring, executive visibility, and resourcing for incident response. It also influences long-term control investments (identity hardening, segmentation, monitoring coverage, and detection engineering) because it represents the greatest potential harm combined with high
Topics
Community Discussion
No community discussion yet for this question.