CAS-004 Governance, Risk, and Compliance Practice Question
An organization is using the FAIR model to quantify risk. Which of the following is a primary component of the FAIR taxonomy?
⚠ Common exam trap
CAS-005 often tests whether candidates can distinguish FAIR's structural taxonomy components (LEF, LM) from derived quantitative outputs (ALE, SLE) or generic risk terms (inherent vs. residual risk).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Loss event frequency and loss magnitude
The FAIR (Factor Analysis of Information Risk) taxonomy decomposes risk into two primary factors: Loss Event Frequency (LEF) — how often a loss event is expected to occur — and Loss Magnitude (LM) — how much loss each event would cause. These two top-level factors are then further decomposed (e.g., LEF into threat event frequency and vulnerability; LM into primary and secondary loss). LEF and LM are the canonical first-level components of the FAIR ontology.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inherent risk and residual risk
Why it's wrong here
Inherent and residual risk describe risk before and after controls, a treatment concept from broader risk management, not FAIR's taxonomy. It tempts because FAIR quantifies how controls reduce loss event frequency and magnitude, which resembles the inherent-versus-residual comparison.
- ✗
Annualized loss expectancy and single loss expectancy
Why it's wrong here
Annualized loss expectancy and single loss expectancy belong to quantitative risk calculation, not the FAIR taxonomy, whose primary components are risk factors such as threat event frequency, vulnerability, and loss magnitude. They are tempting because ALE and SLE genuinely quantify expected monetary loss, making them the right choice when costing risk in classic quantitative analysis.
- ✓
Loss event frequency and loss magnitude
Why this is correct
Loss event frequency and loss magnitude form FAIR's two top-level factors, splitting risk into how often a threat event occurs and how much it costs. This taxonomy directly satisfies the stem's quantification requirement, letting analysts model frequency and magnitude separately rather than relying on qualitative ratings.
- ✗
Threat event frequency and vulnerability
Why it's wrong here
Threat event frequency and vulnerability are separate FAIR factors, not a primary taxonomy component; vulnerability is a modifier of threat capability, not a top-level category. It tempts because both terms appear throughout FAIR analysis, and frequency pairs correctly with loss magnitude as a core factor.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.