CISSP Security and Risk Management Practice Question
In a qualitative risk assessment, a risk with a likelihood rating of 'High' and an impact rating of 'Critical' would typically fall into which category?
⚠ Common exam trap
CISSP often tests the risk matrix combination logic; candidates overthink and pick Medium assuming 'averaging' of High and Critical, when the matrix maps the highest likelihood-impact pair to High risk.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High risk
In a qualitative risk matrix, likelihood and impact ratings are combined to produce an overall risk level. A 'High' likelihood paired with a 'Critical' impact sits at the top of the matrix and is classified as High risk, warranting immediate treatment. Lower combinations (e.g., High likelihood + Low impact) would map to Medium or Low.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
High risk
Why this is correct
In a qualitative risk assessment, "High risk" is assigned when both the likelihood of a threat event occurring and the potential impact of that event on organizational assets or operations are rated as high or critical. This combination signifies a significant exposure that demands immediate attention and substantial resource allocation for mitigation, as the potential for severe damage is both probable and substantial.
- ✗
Medium risk
Why it's wrong here
"Medium risk" is typically assigned in a qualitative risk assessment when either the likelihood or the impact is moderate, or when one factor is high while the other is low, resulting in an intermediate overall risk level. It represents a situation where the potential harm is not catastrophic, and the event is not highly probable, suggesting that mitigation efforts can be prioritized after higher risks are addressed.
- ✗
Low risk
Why it's wrong here
"Low risk" is characterized by both a low likelihood of a threat event occurring and a minimal impact if it were to materialize, according to the qualitative assessment criteria. This combination indicates that the potential for adverse effects on organizational assets or operations is negligible, allowing for less urgent or less resource-intensive mitigation strategies, or even risk acceptance.
- ✗
De minimis risk
Why it's wrong here
"De minimis risk" refers to a level of risk that is so insignificant or trivial that it can be practically ignored, often falling below the threshold for any formal risk management action or resource expenditure. It implies an extremely low likelihood and an almost imperceptible impact, making it economically impractical or unnecessary to expend resources on further analysis or mitigation efforts.
Go deeper
Related to this question
Learn chapter
Security Assessment and Testing
Key term
Risk assessment
Risk assessment is the process of identifying, analyzing, and evaluating potential threats to an organization's assets to determine the likelihood and impact of those threats, and to decide on appropriate treatment measures.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
One of 816 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.