easyMultiple Choice
CRISC Practice Question: A risk assessment that assigns monetary values to…
A risk assessment that assigns monetary values to assets and calculates expected loss is called:
⚠ Common exam trap
It's easy for candidates to confuse 'semi-quantitative' with 'quantitative' because both use numbers, but semi-quantitative methods use ordinal scales or weighted scores (e.g., 1-5) rather than actual monetary values and expected loss calculations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Quantitative
A quantitative risk assessment assigns specific monetary values to assets and calculates expected loss using formulas such as Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF), and Annualized Loss Expectancy (ALE) = SLE × Annualized Rate of Occurrence (ARO). This approach provides objective, numeric risk metrics that support cost-benefit analysis for risk mitigation decisions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Qualitative
Why it's wrong here
Qualitative assessment ranks risks by ordinal scales such as high/medium/low, producing no monetary asset values or expected-loss figures. It is tempting because it suits early, data-poor risk identification where quantification is impractical, but the stem explicitly requires financial valuation and loss calculation, which only quantitative analysis delivers.
- ✗
Semi-quantitative
Why it's wrong here
Semi-quantitative assessment uses descriptive scales and rankings rather than assigning monetary values or calculating expected loss. Monetary valuation with expected loss figures is quantitative. Semi-quantitative suits scenarios where precise financial data is unavailable but relative ranking is needed.
- ✗
Comprehensive
Why it's wrong here
Comprehensive describes assessment scope or coverage, not a calculation method; it specifies no monetary valuation or expected-loss formula. It is tempting because thorough assessments often combine techniques, yet the stem asks for the technique that assigns asset values and computes expected loss, which is quantitative analysis.
- ✓
Quantitative
Why this is correct
Quantitative risk assessment assigns monetary values to assets and calculates expected loss (probability × impact), producing numeric results. This satisfies the stem's requirement for financial valuation and expected-loss calculation, unlike qualitative approaches that rank risks descriptively without monetary figures.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.