mediumMultiple ChoiceObjective-mapped
CCSP Practice Question: Performing a risk assessment of its cloud…
A company is performing a risk assessment of its cloud environment. They have identified a risk with a likelihood of 4 (on a scale of 1-5) and an impact of 3 (on a scale of 1-5). The company decides to implement controls that will reduce the likelihood to 2 and impact to 1. What is the residual risk score after controls?
⚠ Common exam trap
ISC2 often tests the distinction between inherent risk (before controls) and residual risk (after controls), and the trap here is that candidates mistakenly use the original likelihood or impact values in the multiplication instead of the reduced values after controls are applied.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
2
The residual risk score is calculated by multiplying the reduced likelihood (2) by the reduced impact (1) after controls are applied, yielding a score of 2. This represents the risk that remains after implementing security controls, which is the correct interpretation of residual risk in a quantitative risk assessment. The original risk score of 12 (4×3) is the inherent risk, not the residual risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
12
Why it's wrong here
12 is the inherent risk score, not residual.
- ✗
4
Why it's wrong here
4 is not the correct product of likelihood and impact after controls.
- ✓
2
Why this is correct
Correct. Residual risk = 2 (likelihood) * 1 (impact) = 2.
- ✗
3
Why it's wrong here
3 is not the correct product.
Go deeper
Related to this question
About these practice questions
One of 964 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.