What two methods are used to assess risk impact?

Question

Options

• ACost and annual rate of expectance
• BSubjective and Objective
• CQualitative and percent of loss realized
• DQuantitative and qualitative

• A
  8% (2)
• B
  4% (1)
• C
  12% (3)
• D
  77% (20)

Explanation

Quantitative and qualitative are the two universally recognized methods for assessing risk impact in security and risk management frameworks (like CISSP, CompTIA Security+, and NIST). Qualitative assessment uses descriptive scales (low/medium/high) and expert judgment, while quantitative assessment uses numerical values and formulas like ALE (Annualized Loss Expectancy) to assign dollar figures to risk.

Why the distractors fail:

• A is a mix-up: "annual rate of expectance" conflates ARO (Annual Rate of Occurrence), which is a component of quantitative analysis, not a standalone method.
• B is a plausible-sounding fabrication - "subjective vs. objective" isn't a standard risk assessment taxonomy, even though qualitative is inherently more subjective.
• C mixes one real term (qualitative) with "percent of loss realized," which isn't a defined risk assessment methodology.

Memory tip: Think "Q and Q" - the two Q words go together. If an answer has both "Quantitative" and "Qualitative," that's your pair. Any answer mixing in ARO, ALE, or percentages is trying to trick you by inserting components of quantitative analysis in place of the method name itself.

No community discussion yet for this question.