nerdexam
(ISC)2

CAP · Question #287

Jeff, a key stakeholder in your project, wants to know how the risk exposure for the risk events is calculated during quantitative risk analysis. He is worried about the risk exposure which is too…

The correct answer is C. The probability of a risk event times the impact of a risk event determines the true risk. Risk exposure is calculated by multiplying the probability of a risk event by its impact, producing the expected weighted value of that risk.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Jeff, a key stakeholder in your project, wants to know how the risk exposure for the risk events is calculated during quantitative risk analysis. He is worried about the risk exposure which is too low for the events surrounding his project requirements. How is the risk exposure calculated?

Options

  • AThe probability of a risk event plus the impact of a risk event determines the true risk expo
  • BThe risk exposure of a risk event is determined by historical information.
  • CThe probability of a risk event times the impact of a risk event determines the true risk
  • DThe probability and impact of a risk event are gauged based on research and in-depth

How the community answered

(22 responses)
  • A
    5% (1)
  • B
    9% (2)
  • C
    86% (19)

Why each option

Risk exposure is calculated by multiplying the probability of a risk event by its impact, producing the expected weighted value of that risk.

AThe probability of a risk event plus the impact of a risk event determines the true risk expo

Adding probability and impact does not produce a meaningful risk exposure value because it does not correctly represent the weighted relationship between likelihood and consequence.

BThe risk exposure of a risk event is determined by historical information.

Historical information can be used to estimate probability and impact values but is not itself the formula for calculating risk exposure.

CThe probability of a risk event times the impact of a risk event determines the true riskCorrect

Risk exposure, equivalent to Expected Monetary Value in quantitative analysis, is computed as Probability x Impact. This multiplication yields a weighted value that accounts for both the likelihood of the risk occurring and the severity of its consequences, enabling consistent comparison and prioritization of risks across a project.

DThe probability and impact of a risk event are gauged based on research and in-depth

Research and in-depth analysis are methods used to develop probability and impact estimates, not the mathematical formula for computing risk exposure.

Concept tested: Quantitative risk analysis - risk exposure (EMV) calculation

Source: https://www.pmi.org/learning/library/quantitative-risk-analysis-techniques-9673

Topics

#Risk Management#Quantitative Risk Analysis#Risk Exposure#Probability and Impact

Community Discussion

No community discussion yet for this question.

Full CAP Practice