CAS-003 · Question #270
Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating potential risk treatment strategies. As part of the CISO's…
The correct answer is B. Quantitative risk assessment. Qualitative analysis methods use descriptions and words to measure the likelihood and impact of risk. For example, impact ratings can be severe/ high, moderate/medium, or low; and likelihood ratings can be likely, unlikely, or rare. Qualitative analysis is generally…
Question
Following a security assessment, the Chief Information Security Officer (CISO) is reviewing the results of the assessment and evaluating potential risk treatment strategies. As part of the CISO's evaluation, a judgment of potential impact based on the identified risk is performed. To prioritize response actions, the CISO uses past experience to take into account the exposure factor as well as the external accessibility of the weakness identified. Which of the following is the CISO performing?
Options
- ADocumentation of lessons learned
- BQuantitative risk assessment
- CQualitative assessment of risk
- DBusiness impact scoring
- EThreat modeling
How the community answered
(32 responses)- A9% (3)
- B72% (23)
- C13% (4)
- D3% (1)
- E3% (1)
Explanation
Qualitative analysis methods use descriptions and words to measure the likelihood and impact of risk. For example, impact ratings can be severe/ high, moderate/medium, or low; and likelihood ratings can be likely, unlikely, or rare. Qualitative analysis is generally scenario-based. A weakness of qualitative risk analysis lies with its sometimes subjective and untestable methodology. You can also assign numbers between 0 and 9 for exposures and damage potential. However, you do not perform calculations on the numbers assigned to the risks. The goal of qualitative assessment is to rank the risks on a scale of 1 to 25, for example. Quantitative analysis is based completely on numeric values. Data is analyzed using historic records, experiences, industry best practices and records, statistical theories, testing, and experiments. This methodology may be weak in situations where risk is not easily quantifiable. The goal of quantitative analysis is to calculate the probable loss for every risk.
Topics
Community Discussion
No community discussion yet for this question.