Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A mid-sized company is conducting a qualitative risk assessment for its cloud migration. The security team has limited historical data and wants to involve multiple stakeholders to reduce individual bias. They need to categorize risks as high, medium, or low and prioritize them for remediation. Which combination of techniques best fits this scenario?

   • ABrainstorming sessions followed by a risk matrix to categorize and prioritize risks.
   • BMonte Carlo simulation to model loss probabilities and then assign high/medium/low labels.
   • CSingle expert judgment using a checklist of common cloud risks without stakeholder input.
   • DDelphi method followed by quantitative ALE calculations for each identified risk.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which qualitative technique involves gathering expert opinions through multiple rounds of anonymous questionnaires?

   • ABrainstorming
   • BScenario analysis
   • CRisk matrix
   • DDelphi method
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the correct sequence of steps in a quantitative risk assessment?

   • ARisk calculation, asset valuation, threat identification, vulnerability analysis
   • BVulnerability analysis, asset valuation, threat identification, risk calculation
   • CThreat identification, asset valuation, vulnerability analysis, risk calculation
   • DAsset valuation, threat identification, vulnerability analysis, risk calculation
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A small e-commerce company is choosing between a quantitative and a qualitative risk assessment for its cloud infrastructure. The company has a limited budget, no dedicated risk analyst, and needs results within two weeks to support a security investment decision. Which factor most strongly favors a qualitative approach in this scenario?

   • AThe need for precise monetary loss estimates
   • BThe availability of extensive historical incident data
   • CThe requirement for speed, low cost, and minimal expertise
   • DThe need to satisfy regulatory requirements for dollar-based risk reporting
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   Which step in a qualitative risk assessment involves ranking risks based on their severity and likelihood?

   • ARisk prioritization
   • BRisk identification
   • CRisk categorization
   • DRisk mitigation
   Reveal Solution Discussion Select an answer first