ISC2 CC Security Principles Practice Question
A financial services firm is classifying a risk by estimating how often a particular attack is likely to succeed in a given year. Which risk concept is the firm measuring?
⚠ Common exam trap
Watch out — candidates often confuse the frequency of an event with its financial consequence, so that any risk term involving loss amounts is selected instead of the probability being estimated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk likelihood
Risk combines the likelihood that a threat exploits a vulnerability with the impact if it does. The firm is estimating how often an attack succeeds per year, which is precisely the likelihood dimension. Annualized loss expectancy and impact deal with cost or severity, while residual risk refers to what remains after controls are applied, so likelihood is the concept being quantified.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Residual risk
Why it's wrong here
Residual risk is the risk that remains after controls and countermeasures have been applied. The scenario does not mention any existing controls or mitigation; it describes estimating how often an attack succeeds. That is a raw likelihood estimate rather than what is left over after treatment, so residual risk is a different concept and does not describe the firm's activity here.
- ✗
Annualized loss expectancy (ALE)
Why it's wrong here
Annualized loss expectancy expresses the expected monetary loss per year, calculated by multiplying single loss expectancy by annualized rate of occurrence. The firm is estimating how frequently an attack succeeds, not the financial impact of those successes. ALE would require cost figures for each loss event, which the scenario does not mention, so it is not the concept being measured.
- ✓
Risk likelihood
Why this is correct
Risk likelihood is the probability or frequency that a threat will exploit a vulnerability and cause harm within a defined period. By estimating how often an attack is likely to succeed in a year, the firm is directly quantifying likelihood, which is one of the two core dimensions of risk alongside impact. This estimate then feeds into risk analysis and prioritization, making it the concept the firm is measuring.
- ✗
Risk impact
Why it's wrong here
Risk impact describes the magnitude of harm or loss if a threat event occurs, such as financial cost, operational disruption, or reputational damage. The firm in this scenario is assessing frequency of success, not severity of consequence. Impact and likelihood are separate dimensions, and estimating how often something happens answers the likelihood question, so impact does not fit the stated measurement.
Go deeper
Related to this question
Learn chapter
Risk Management and Security Controls
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
Key term
Impact
Impact is the measure of the potential damage or harm that a risk event could cause to an organization's assets, operations, or reputation.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.