Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   When is it most appropriate to use a qualitative risk assessment?

   • AWhen historical data and statistical information are readily available
   • BWhen a quick, high-level risk prioritization is needed with limited data
   • CWhen the organization requires exact annual loss estimates
   • DWhen precise monetary values are required for cost-benefit analysis
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a key characteristic of qualitative risk assessment?

   • AIt relies on descriptive scales and subjective judgment to rank risks.
   • BIt uses numerical values to calculate annualized loss expectancy.
   • CIt produces results in monetary terms for cost-benefit analysis.
   • DIt requires detailed asset valuation and probability estimates.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security consultant is helping a client perform a qualitative risk assessment for a cloud environment. The client's management is concerned that the results may be too subjective and inconsistent across different business units. The consultant wants to improve the reliability of the qualitative assessment without switching to a full quantitative approach. Which strategy is most effective?

   • AConvert all qualitative ratings to numerical scores and treat them as quantitative data.
   • BUse brainstorming sessions without a structured framework to encourage open discussion.
   • CRely on a single senior expert to perform the assessment for all business units.
   • DUse a standardized risk matrix with clearly defined likelihood and impact criteria, and train all assessors on its use.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A security analyst is tasked with performing a quantitative risk assessment for a cloud storage service. The analyst has detailed asset inventories and historical incident data. However, the assessment is taking longer than expected because of the need to assign precise monetary values to every asset and calculate SLE and ALE for each threat. What is the primary disadvantage of the quantitative approach being experienced?

   • AIt is time-consuming and resource-intensive due to the need for detailed data and calculations.
   • BIt produces results that are too subjective and difficult to defend.
   • CIt only identifies risks but does not help prioritize them.
   • DIt cannot be used for cloud environments because of shared responsibility.
   Reveal Solution Discussion Select an answer first
6. 35foundation · easy

   Which statement best describes a qualitative risk assessment?

   • AIt calculates risk using monetary values and statistical data.
   • BIt uses descriptive scales and subjective judgment to evaluate risk.
   • CIt requires extensive historical data and complex mathematical models.
   • DIt produces precise monetary estimates of potential losses.
   Reveal Solution Discussion Select an answer first