Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a typical advantage of qualitative risk assessment over quantitative?

   • AIt eliminates subjectivity from the assessment.
   • BIt is more accurate than quantitative assessment.
   • CIt is easier to perform and requires less data.
   • DIt provides exact monetary values for risk.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security manager must choose between quantitative and qualitative risk assessment for a cloud migration project. The project has a tight deadline, and the team has limited experience with statistical analysis. However, the CFO has requested a cost-benefit analysis for security controls. The manager needs to provide a defensible prioritization of risks. What is the most appropriate decision?

   • ADelay the assessment until the team can be trained in quantitative methods.
   • BUse qualitative assessment because it is faster and the team lacks statistical expertise, then present a prioritized list.
   • CUse quantitative assessment despite the team's limited expertise, relying on external consultants to perform the calculations.
   • DUse a hybrid approach: qualitative for initial prioritization and quantitative for the top risks to support the cost-benefit analysis.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational corporation is assessing risks for a multi-cloud deployment. The board requires a cost-benefit analysis for each risk, but the organization operates in regions with varying data protection laws and has limited historical data for some cloud-specific threats. The risk team is experienced and has access to threat intelligence feeds. Which approach best balances the board's requirement with the data limitations?

   • AUse a hybrid approach: quantify risks with sufficient data using ALE, and use qualitative scales for risks with insufficient data, then present both in the board report.
   • BDelay the risk assessment until sufficient historical data is collected.
   • CPerform a purely quantitative assessment using ALE calculations for all risks.
   • DPerform a purely qualitative assessment using a risk matrix and expert judgment.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security team is conducting a qualitative risk assessment for a cloud environment. They have a diverse group of stakeholders with different levels of expertise. The team wants to avoid the influence of dominant personalities and ensure that all opinions are considered equally. They also need to categorize risks as high, medium, or low. Which combination of techniques is most effective?

   • ABrainstorming followed by a risk matrix
   • BSingle expert judgment using a risk matrix
   • CNominal group technique followed by quantitative ALE calculations
   • DDelphi method followed by a risk matrix
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A healthcare organization is conducting a qualitative risk assessment for its cloud-based patient portal. The team has identified several risks and now needs to categorize them as high, medium, or low. They want to use a structured method that considers both the likelihood and impact of each risk. Which technique is most appropriate for this step?

   • ADelphi method
   • BRisk matrix
   • CMonte Carlo simulation
   • DBrainstorming
   Reveal Solution Discussion Select an answer first