CISSP Practice Question: A security manager is conducting a risk…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Scenario-based risk analysis with ordinal scales

  Why it's wrong here

  Scenario-based risk analysis with ordinal scales involves identifying potential risk events and evaluating their impact and likelihood using non-numerical, ranked categories such as 'low,' 'medium,' or 'high.' While this method helps in understanding and prioritizing risks within specific contexts, it does not assign precise monetary values to potential losses. Therefore, it is unsuitable for directly estimating the financial impact required for detailed cost-benefit analysis or budget allocation.

• ✗

  Qualitative risk analysis using high/medium/low ratings

  Why it's wrong here

  Qualitative risk analysis, by its very nature, categorizes and prioritizes risks using descriptive terms like 'high,' 'medium,' or 'low' for likelihood and impact, often represented in a risk matrix. This approach provides a subjective, relative understanding of risk severity and helps in initial screening and communication. However, it deliberately avoids assigning specific numerical or financial values to potential losses, making it incapable of producing the monetary estimates needed for quantitative financial planning.

• ✗

  Benchmarking against industry standards

  Why it's wrong here

  Benchmarking against industry standards is a comparative process where an organization evaluates its security controls, practices, or posture against those of peer organizations or established best practices. While valuable for identifying gaps, improving security maturity, and demonstrating due diligence, it is not a direct risk analysis methodology designed to calculate specific financial losses for an organization's unique assets and threat landscape. It provides context for improvement, not a monetary loss estimate.

• ✓

  Quantitative risk analysis using annualized loss expectancy (ALE)

  Why this is correct

  Quantitative risk analysis directly assigns monetary values to assets, threats, and vulnerabilities to calculate potential financial losses. This method precisely determines the Single Loss Expectancy (SLE), which is the monetary loss from a single occurrence of a threat, and the Annualized Rate of Occurrence (ARO), which is how often the threat is expected to occur per year. Multiplying SLE by ARO yields the Annualized Loss Expectancy (ALE), providing a clear monetary estimate of expected losses over a year, which is essential for financial decision-making.

Go deeper

Related to this question