200-201 Security Policies and Procedures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Quantitative risk assessment

  Why this is correct

  Quantitative risk assessment assigns numerical values to both likelihood and impact, satisfying the stem's requirement for numeric scoring. Unlike qualitative methods, which use descriptive scales such as high, medium or low, it enables arithmetic calculation of expected loss and direct cost-benefit comparison of controls.

• ✗

  Operational risk assessment

  Why it's wrong here

  Operational risk assessment concerns risks arising from people, processes and systems disrupting day-to-day business activities; it is a risk category, not a method of assigning numerical likelihood and impact values. It is tempting because operational failures are commonly assessed, but the stem asks about the assessment technique, which is quantitative.

• ✗

  Qualitative risk assessment

  Why it's wrong here

  Qualitative assessment ranks likelihood and impact using descriptive scales such as low, medium and high, producing no numerical values. It is tempting because it is faster and needs less data, and suits initial screening or workshops where calibrated figures are unavailable, but the stem explicitly requires numerical assignment, which is quantitative.

• ✗

  Hybrid risk assessment

  Why it's wrong here

  A hybrid assessment combines qualitative ranking with quantitative scoring, but the stem describes assigning numerical values to likelihood and impact throughout, which is purely quantitative. Hybrid is tempting where some risks lack reliable data and others are modelled numerically, yet no qualitative element is stated here.