Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a primary advantage of qualitative risk assessment?

   • AIt eliminates the need for expert judgment.
   • BIt provides precise monetary estimates of risk.
   • CIt is easy to perform and does not require extensive data.
   • DIt produces results that are more objective than quantitative.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which statement correctly compares quantitative and qualitative risk assessment?

   • AQuantitative uses numerical data and is more accurate, while qualitative uses descriptive scales and is simpler.
   • BQualitative provides more precise results than quantitative.
   • CQuantitative is faster and less complex than qualitative.
   • DBoth methods produce identical results and can be used interchangeably.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the typical output of a qualitative risk assessment?

   • AExact probabilities of threat occurrence
   • BA prioritized list of risks categorized as high, medium, or low
   • CMonetary values such as annualized loss expectancy
   • DDetailed cost-benefit analysis for each control
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In a quantitative risk assessment, which step involves determining the financial value of an asset?

   • ARisk calculation
   • BAsset valuation
   • CThreat identification
   • DVulnerability analysis
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A healthcare organization is assessing risks for moving patient-facing applications to the cloud. They have reliable cost data for potential data breaches but lack historical data on the likelihood of new cloud-specific threats. They need to produce a prioritized risk register that is both financially meaningful and accepted by clinical stakeholders who prefer descriptive ratings. Which approach is most appropriate?

   • AUse only qualitative methods, such as brainstorming and a risk matrix, to ensure stakeholder buy-in.
   • BOutsource the risk assessment to a third-party vendor to obtain a fully quantitative result.
   • CUse only quantitative methods, calculating ALE for every identified risk.
   • DApply a hybrid approach: quantify risks with sufficient data using ALE, and use qualitative scales for risks lacking likelihood data, then combine results in a prioritized register.
   Reveal Solution Discussion Select an answer first