CRISC IT Risk Assessment Practice Question
A risk assessment using a 5x5 heat map with likelihood and impact scores is an example of which type of risk analysis?
⚠ Common exam trap
A common mix-up: candidates confuse the use of numbers (1–5) with quantitative analysis, but the 5x5 heat map remains qualitative because the numbers are labels, not measured values with arithmetic meaning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Qualitative risk analysis
A 5x5 heat map uses ordinal scales (e.g., 1–5) for likelihood and impact, which are subjective categories rather than precise numerical values. This places it in qualitative risk analysis, where risks are ranked by descriptive labels (e.g., Low, Medium, High) without monetary or statistical quantification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Semi-quantitative risk analysis
Why it's wrong here
Semi-quantitative assigns numeric values to scales but is not purely qualitative.
- ✗
Factor Analysis of Information Risk (FAIR)
Why it's wrong here
FAIR is a quantitative framework.
- ✓
Qualitative risk analysis
Why this is correct
Heat maps are a common qualitative tool.
- ✗
Quantitative risk analysis
Why it's wrong here
Quantitative analysis uses numerical values and formulas like ALE.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.