Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which statement best describes a quantitative risk assessment?

   • AIt assigns numerical values and monetary amounts to assets, threats, and potential losses.
   • BIt focuses only on identifying threats without estimating the likelihood or impact.
   • CIt relies primarily on expert opinion and subjective judgment to prioritize risks.
   • DIt uses descriptive scales such as high, medium, and low to rank risks.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A large enterprise is assessing risks for its multi-cloud environment. The risk team has reliable financial data for some assets but not for others. Management wants both a prioritized list of risks and monetary impact estimates for budget planning. Which approach best satisfies these requirements?

   • AConduct a purely qualitative assessment to ensure consistency across all assets.
   • BConduct a purely quantitative assessment using estimated values for all assets.
   • CUse a hybrid approach: quantitative for assets with reliable data and qualitative for others, then combine results into a unified risk register.
   • DPerform two separate assessments and present them independently to management.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A risk manager is leading a quantitative risk assessment for a cloud-based ERP system. The team has spent several weeks collecting asset values and calculating SLE and ALE for each threat. The manager is now concerned that the assessment is taking too long and consuming too many resources. What is the most effective way to address this concern while maintaining the benefits of quantitative assessment?

   • ALimit the quantitative assessment to the most critical assets and threats, and use qualitative for the rest.
   • BSwitch to a qualitative assessment to save time, even though it will lose monetary precision.
   • CContinue the quantitative assessment as planned, regardless of the time and cost.
   • DUse a simpler quantitative formula that requires less data, such as only calculating SLE without ALE.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which quantitative technique is used to estimate the expected annual loss from a risk?

   • AAnnualized Loss Expectancy (ALE)
   • BExposure Factor (EF)
   • CSingle Loss Expectancy (SLE)
   • DAnnualized Rate of Occurrence (ARO)
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A risk analyst is performing a quantitative risk assessment for a cloud storage service. The analyst has completed asset valuation and threat identification. What should the analyst do next in the process?

   • ACalculate the Annualized Loss Expectancy (ALE) immediately.
   • BImplement security controls to reduce risk.
   • CAnalyze vulnerabilities and determine the likelihood of each threat exploiting them.
   • DAssign qualitative ratings to each threat.
   Reveal Solution Discussion Select an answer first