mediumMultiple SelectObjective-mapped
CAS-004 Practice Question: A security analyst is performing a risk…
A security analyst is performing a risk assessment for a critical application. Which TWO of the following are characteristics of a quantitative risk assessment methodology?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Calculates Annualized Loss Expectancy (ALE)
Quantitative risk assessment uses numerical values and dollar amounts to calculate risk. Option A (Calculates Annualized Loss Expectancy (ALE)) is correct because ALE is a quantitative metric (ALE = SLE × ARO). Option E (Assigns dollar values to assets and potential losses) is also correct because quantitative assessment assigns monetary values. Option B is qualitative, relying on expert judgment. Option C is incorrect; Exposure Factor (EF) is part of quantitative assessment, but it is not a characteristic of the methodology itself—rather, it's an input. Option D uses qualitative ratings. Therefore, the correct choices are A and E.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Calculates Annualized Loss Expectancy (ALE)
Why this is correct
ALE is a key output of quantitative risk assessment.
- ✗
Relies on expert judgment and scenarios
Why it's wrong here
This describes qualitative assessment, not quantitative.
- ✗
Determines Exposure Factor (EF) for each asset
Why it's wrong here
Although EF is used in quantitative, it is a component, not a defining characteristic of the methodology itself.
- ✗
Uses high/medium/low ratings for likelihood and impact
Why it's wrong here
This is a qualitative approach, not quantitative.
- ✓
Assigns dollar values to assets and potential losses
Why this is correct
Quantitative risk assessment uses monetary values to quantify risk.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.