A cybersecurity analyst is choosing between qualitative and quantitative risk assessment methods for a new project. The project has limited historical data on threat events, but the stakeholders need a clear financial justification for risk mitigation investments. The analyst also needs to compare risks across different business units with varying levels of risk tolerance. Which approach is most appropriate?

Quantitative, because it is always more accurate than qualitative.

A hybrid approach, using qualitative for initial screening and quantitative for high-priority risks.

Qualitative, because it uses expert judgment and is easier to apply when data is scarce.

Quantitative, because it provides monetary values that directly support cost-benefit analysis.

A cybersecurity analyst is evaluating risks for a new cloud storage service. The analyst needs to prioritize risks based on potential financial loss. The analyst estimates that a data breach could cost $500,000 and has a 10% chance of occurring in the next year. Another risk involves a service outage that could cost $200,000 with a 30% chance of occurring. Which risk should be prioritized based on annualized loss expectancy (ALE)?

The service outage risk, because its ALE is $60,000.

Both risks have equal priority because they both exceed $50,000 in ALE.

The data breach risk, because its ALE is $50,000.

The data breach risk, because its potential impact is higher.

Certified Cybersecurity Operations Analyst

Domain 2Objective 2

Risk Management CCOA Practice Questions (Page 1)

Part of the Domain 2: Cybersecurity Principles and Risk domain, which accounts for 20% of the CCOA exam. ISACA does not publish an official question count, but from its 240-minute exam (~95–160 total, ~19–32 in this domain), expect 5–8 from this objective — we provide 28 practice questions to prepare you well beyond it. (estimate)

28questions here

6free pages

5concepts

20%of the exam

Questions 1–5

1application · medium
A risk analyst is using a quantitative risk assessment to evaluate the risk of a phishing attack. The analyst estimates that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the annualized loss expectancy (ALE)?
Select an answer first
2expert · hard
A cybersecurity analyst is choosing between qualitative and quantitative risk assessment methods for a new project. The project has limited historical data on threat events, but the stakeholders need a clear financial justification for risk mitigation investments. The analyst also needs to compare risks across different business units with varying levels of risk tolerance. Which approach is most appropriate?
Select an answer first
3application · medium
A cybersecurity analyst is evaluating risks for a new cloud storage service. The analyst needs to prioritize risks based on potential financial loss. The analyst estimates that a data breach could cost $500,000 and has a 10% chance of occurring in the next year. Another risk involves a service outage that could cost $200,000 with a 30% chance of occurring. Which risk should be prioritized based on annualized loss expectancy (ALE)?
Select an answer first
4foundation · easy
Which cybersecurity objective ensures that data is not altered or destroyed by unauthorized parties?
Select an answer first
5foundation · easy
An organization implements multi-factor authentication (MFA) to prevent unauthorized access to sensitive systems. Which core cybersecurity objective is primarily being strengthened?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to CCOA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CCOA” is a trademark of its owner, used for identification only.

Risk Management CCOA Practice Questions (Page 1)

Questions 1–5

A risk analyst is using a quantitative risk assessment to evaluate the risk of a phishing attack. The analyst estimates that the single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the annualized loss expectancy (ALE)?

Which cybersecurity objective ensures that data is not altered or destroyed by unauthorized parties?

An organization implements multi-factor authentication (MFA) to prevent unauthorized access to sensitive systems. Which core cybersecurity objective is primarily being strengthened?

Keep studying — Domain 2: Cybersecurity Principles and Risk