SY0-701 Security Program Management and Oversight Practice Question
Leadership is deciding between two security controls for a customer portal outage risk. Finance wants to compare the options in dollars, using expected loss, not just a high/medium/low rating. Which approach should the analyst use?
⚠ Common exam trap
Many exam-takers confuse qualitative risk analysis with quantitative, thinking that any risk assessment that uses categories is sufficient, but the question explicitly demands monetary comparison, which only quantitative analysis provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Quantitative risk analysis, because it expresses likelihood and impact in monetary terms.
Quantitative risk analysis (A) is correct because it assigns monetary values to both the likelihood and impact of a risk, enabling a direct dollar-based comparison of expected loss. The Finance team's requirement for a dollar comparison rules out qualitative ratings, making quantitative analysis the only approach that meets their needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Quantitative risk analysis, because it expresses likelihood and impact in monetary terms.
Why this is correct
Quantitative risk analysis is the right method when decision-makers want financial comparisons. It uses numerical estimates such as annual loss expectancy, cost of control, and probable impact in dollars. That allows leadership to compare mitigation options against the expected reduction in loss and make a budget-based decision. In this situation, the business specifically wants a dollar-based analysis rather than a subjective ranking.
- ✗
Qualitative risk analysis, because it uses categories like critical, medium, and low.
Why it's wrong here
Qualitative risk analysis uses ordinal categories such as critical, medium, or low to rank risks based on subjective judgment and expert opinion. While this approach is quick and useful for triage, it does not assign monetary values to likelihood or impact, so it cannot support a cost-benefit comparison of security controls in dollars. The finance-driven scenario specifically requires an annualized loss expectancy or similar numerical metric, which qualitative analysis cannot produce.
- ✗
Business impact analysis, because it identifies which business processes are important.
Why it's wrong here
A business impact analysis helps identify critical functions and recovery priorities, but it is not the primary method for comparing control costs against monetary risk reduction. It supports risk decisions, rather than replacing risk analysis.
- ✗
Risk avoidance, because eliminating the activity removes the threat completely.
Why it's wrong here
Risk avoidance is a risk treatment strategy that eliminates the risky activity or exposure entirely, for example by discontinuing a vulnerable service or removing a high-risk feature. However, it is not an analysis technique, and it does not express likelihood and impact in monetary terms, so it cannot be used to compare control options against expected loss. Moreover, choosing avoidance is a decision made *after* conducting risk analysis, and in many operational settings it is infeasible because the business function must continue.
Go deeper
Related to this question
Learn chapter
Risk Management Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Quantitative risk analysis
Quantitative risk analysis is a structured process that uses numerical data and statistical methods to calculate the potential financial impact of risks on an organization's assets and projects.
About these practice questions
One of 1,013 original SY0-701 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.