Quantitative vs. Qualitative Risk Assessment CSE Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Which of the following is a key characteristic of quantitative risk assessment?

   • AIt relies on numerical data and monetary values to calculate risk.
   • BIt is faster and less resource-intensive than other methods.
   • CIt expresses risk in terms of descriptive labels like 'critical' or 'minor'.
   • DIt uses subjective judgment to assign risk levels.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A company is evaluating the risk of a ransomware attack on its file servers. The servers are valued at $200,000, and an attack would likely destroy 50% of the data's value. The estimated frequency of such an attack is once every 4 years. What is the Single Loss Expectancy (SLE)?

   • A$100,000
   • B$25,000
   • C$200,000
   • D$50,000
   Reveal Solution Discussion Select an answer first
4. 38application · medium

   A company is assessing the risk of a denial-of-service (DoS) attack on its public-facing web application. The application generates $1,000,000 in annual revenue, and a successful attack would cause a 10% loss of revenue for the year. The estimated frequency of such an attack is once every 2 years. What is the Annualized Loss Expectancy (ALE)?

   • A$100,000
   • B$200,000
   • C$500,000
   • D$50,000
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A security team is using a qualitative risk assessment to evaluate threats to a cloud-based CRM. They have identified a list of potential risks and need to prioritize them. Which technique would be most effective for this purpose?

   • ACalculate the Exposure Factor (EF) for each risk.
   • BConduct a Monte Carlo simulation to model loss distributions.
   • CPerform a cost-benefit analysis of potential controls.
   • DUse a risk matrix to combine likelihood and impact ratings into a priority level.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A small business with a limited security budget is performing its first cloud risk assessment. The team has no historical loss data and limited expertise. They need a quick, low-cost method to identify and prioritize risks. They decide to use a qualitative approach. What is the primary disadvantage they should be aware of?

   • AIt produces monetary values that are often inaccurate.
   • BThe process is too complex and requires specialized statistical training.
   • CIt requires extensive historical data to be meaningful.
   • DThe results are highly subjective and may vary depending on who performs the assessment.
   Reveal Solution Discussion Select an answer first