mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A security team is conducting a qualitative risk…
A security team is conducting a qualitative risk assessment for a new cloud application. They want to prioritize risks based on likelihood and impact. Which method should they use to combine these factors?
⚠ Common exam trap
Candidates often confuse qualitative risk assessment with quantitative methods like ALE, assuming any combination of likelihood and impact requires numerical calculation, but the question explicitly states 'qualitative', which directly points to a risk matrix.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Risk matrix (heat map)
A risk matrix (heat map) is the correct method because it combines qualitative assessments of likelihood and impact into a single visual grid, allowing the team to prioritize risks by their position in the matrix. This approach is standard for qualitative risk assessments where numerical data is unavailable, as it maps ordinal ratings (e.g., low, medium, high) to a color-coded priority level.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Risk matrix (heat map)
Why this is correct
A qualitative risk matrix uses ordinal scales for likelihood and impact to produce risk ratings.
- ✗
SWOT analysis
Why it's wrong here
SWOT examines strengths, weaknesses, opportunities, threats, not specifically risk ranking.
- ✗
Annualized loss expectancy (ALE)
Why it's wrong here
ALE is a quantitative formula, not qualitative.
- ✗
Business Impact Analysis (BIA)
Why it's wrong here
BIA identifies critical functions and impacts of disruption, not combined risk rating.
Go deeper
Related to this question
About these practice questions
One of 920 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.