Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team is conducting a qualitative risk assessment for a new cloud application. They have identified several risks and need to prioritize them for remediation. Which technique is most appropriate for categorizing and prioritizing these risks?

   • AUse a risk matrix to plot likelihood against impact and assign ratings such as high, medium, or low.
   • BConduct a cost-benefit analysis for each control option.
   • CCalculate the Annualized Loss Expectancy (ALE) for each risk.
   • DPerform a Monte Carlo simulation to model potential losses.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A large enterprise is deciding whether to invest in a quantitative risk assessment for its cloud environment. The CISO argues that quantitative results are more persuasive to the board, but the CFO is concerned about the cost and time required. The organization has a mature security data collection process and a dedicated risk team. Which consideration most strongly supports proceeding with a quantitative assessment?

   • AThe organization has sufficient historical data and expertise to produce reliable monetary estimates.
   • BThe board prefers descriptive ratings over numerical figures.
   • CThe organization lacks historical incident data for cloud threats.
   • DThe organization needs results quickly and with minimal effort.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a primary advantage of quantitative risk assessment?

   • AIt is less expensive to conduct than qualitative assessment.
   • BIt is quick and requires minimal data.
   • CIt provides precise, monetary-based results that support cost-benefit analysis.
   • DIt relies entirely on expert opinion without numerical data.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which factor would most strongly favor the use of a quantitative risk assessment?

   • AThe risks are well understood and can be described with simple labels.
   • BThe organization has limited time and expertise.
   • CThe organization needs to justify security investments with monetary figures.
   • DThe organization prefers a subjective approach.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A risk analyst is calculating the ALE for a cloud database. The asset value is $1,000,000. The exposure factor is 20% because a breach would only affect a portion of the data. Historical data shows that a breach occurs once every 10 years. However, the analyst mistakenly uses an ARO of 0.1 but forgets to convert the exposure factor to a decimal, using 20 instead of 0.20. What ALE will the analyst calculate?

   • A$200,000
   • B$20,000
   • C$2,000,000
   • D$2,000,000
   Reveal Solution Discussion Select an answer first