CAS-004 Governance, Risk, and Compliance Practice Question
A security manager is evaluating two risk quantification approaches: Factor Analysis of Information Risk (FAIR) and a qualitative heat map. Which of the following is a key advantage of using FAIR over the qualitative heat map?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FAIR provides a monetary value for risk, enabling ROI calculations
FAIR provides a more rigorous, quantitative analysis that enables cost-benefit analysis, unlike qualitative methods.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FAIR is the only framework recognized by NIST
Why it's wrong here
NIST recognizes multiple frameworks, including qualitative ones.
- ✗
FAIR is easier to communicate to non-technical stakeholders
Why it's wrong here
FAIR's reliance on probabilistic modelling and financial quantification can initially present a steeper learning curve for non-technical stakeholders compared to the immediate visual simplicity of a qualitative heat map. Heat maps offer instant, high-level risk categorisation without requiring an understanding of underlying calculations. However, FAIR is designed to translate complex technical risks into a common financial language, making it highly effective for justifying risk treatment investments and prioritising actions based on tangible monetary impact once the methodology is grasped.
- ✗
FAIR requires less data and expertise to implement
Why it's wrong here
FAIR is data-intensive and requires expertise.
- ✓
FAIR provides a monetary value for risk, enabling ROI calculations
Why this is correct
Correct: FAIR produces dollar figures for risk, supporting cost-benefit decisions.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.