Upper management decides which risk to mitigate based on cost. This is an example of:

The correct answer is D. Quantitative risk assessment. Quantitative risk assessment assigns specific monetary values to risks using metrics such as Single Loss Expectancy (SLE), Annual Rate of Occurrence (ARO), and Annual Loss Expectancy (ALE). Because it produces dollar-denominated outputs, management can directly compare the cost…

Security program management and oversight

Question

Options

AQualitative risk assessment
BBusiness impact analysis
CRisk management framework
DQuantitative risk assessment

How the community answered

(33 responses)

A
3% (1)
B
6% (2)
C
3% (1)
D
88% (29)

Explanation

Quantitative risk assessment assigns specific monetary values to risks using metrics such as Single Loss Expectancy (SLE), Annual Rate of Occurrence (ARO), and Annual Loss Expectancy (ALE). Because it produces dollar-denominated outputs, management can directly compare the cost of a risk against the cost of a countermeasure to make cost-justified decisions-exactly what is described here. Qualitative risk assessment (A) uses descriptive ratings (high/medium/low) without specific financial figures, making cost comparisons less precise. A business impact analysis (B) focuses on how disruptions affect business operations. A risk management framework (C) is a structured process or standard (e.g., NIST RMF) used to govern risk programs, not a specific assessment type.

Topics

#quantitative risk assessment#risk management#cost-benefit analysis#risk mitigation

Community Discussion

No community discussion yet for this question.

Full SY0-301 Practice