CGRC · Question #283
Which of the following relations correctly describes total risk? Response:
The correct answer is B. Total Risk = Threats x Vulnerability x Asset Value. Total risk is fundamentally calculated as the product of threats, vulnerabilities, and the value of the asset at risk.
Question
Which of the following relations correctly describes total risk? Response:
Options
- ATotal Risk = Viruses x Exploit x Asset Value
- BTotal Risk = Threats x Vulnerability x Asset Value
- CTotal Risk = Viruses x Vulnerability x Asset Value
- DTotal Risk = Threats x Exploit x Asset Value
How the community answered
(32 responses)- A3% (1)
- B94% (30)
- C3% (1)
Why each option
Total risk is fundamentally calculated as the product of threats, vulnerabilities, and the value of the asset at risk.
Viruses are a specific type of threat, and 'Exploit' is a mechanism, making this formula too narrow and not a general representation of total risk.
Total risk is commonly understood as the potential for loss or damage, which arises when a threat source exploits a vulnerability in an asset, causing harm. The formula 'Threats x Vulnerability x Asset Value' accurately captures this relationship, where a threat leverages a weakness (vulnerability) in something valuable (asset).
Viruses are a specific type of threat, making this formula too specific and not a comprehensive general model for total risk.
'Exploit' is a mechanism used by a threat, not a direct factor like 'vulnerability' that determines the likelihood of the threat succeeding in causing harm.
Concept tested: Total risk calculation formula
Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.