nerdexam
(ISC)2

CGRC · Question #283

Which of the following relations correctly describes total risk? Response:

The correct answer is B. Total Risk = Threats x Vulnerability x Asset Value. Total risk is fundamentally calculated as the product of threats, vulnerabilities, and the value of the asset at risk.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

Which of the following relations correctly describes total risk? Response:

Options

  • ATotal Risk = Viruses x Exploit x Asset Value
  • BTotal Risk = Threats x Vulnerability x Asset Value
  • CTotal Risk = Viruses x Vulnerability x Asset Value
  • DTotal Risk = Threats x Exploit x Asset Value

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    94% (30)
  • C
    3% (1)

Why each option

Total risk is fundamentally calculated as the product of threats, vulnerabilities, and the value of the asset at risk.

ATotal Risk = Viruses x Exploit x Asset Value

Viruses are a specific type of threat, and 'Exploit' is a mechanism, making this formula too narrow and not a general representation of total risk.

BTotal Risk = Threats x Vulnerability x Asset ValueCorrect

Total risk is commonly understood as the potential for loss or damage, which arises when a threat source exploits a vulnerability in an asset, causing harm. The formula 'Threats x Vulnerability x Asset Value' accurately captures this relationship, where a threat leverages a weakness (vulnerability) in something valuable (asset).

CTotal Risk = Viruses x Vulnerability x Asset Value

Viruses are a specific type of threat, making this formula too specific and not a comprehensive general model for total risk.

DTotal Risk = Threats x Exploit x Asset Value

'Exploit' is a mechanism used by a threat, not a direct factor like 'vulnerability' that determines the likelihood of the threat succeeding in causing harm.

Concept tested: Total risk calculation formula

Source: https://nvlpubs.nist.gov/nistpubs/legacy/sp/nistspecialpublication800-30r1.pdf

Topics

#Risk Management#Risk Calculation#Threats#Vulnerabilities

Community Discussion

No community discussion yet for this question.

Full CGRC Practice