Qualitative Risk Analysis: Matrix Rating for High Probability and Medium Impact
During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?
⚠ Common exam trap
ISC2 often tests the misconception that high impact alone is sufficient for a 'High' risk rating, ignoring that probability must also be high to reach the top risk level.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High probability and high impact
In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
High probability and high impact
Why this is correct
Qualitative risk matrices derive ratings from likelihood and consequence, so high probability combined with high impact maps directly to a High rating. This satisfies the stem's request for the factor combination producing that specific rating.
- ✗
Low probability and low impact
Why it's wrong here
Low probability and low impact produce a Low rating, as both axes sit at the bottom of the matrix. This combination is the baseline case analysts use to justify accepting a risk without further treatment, so it cannot generate a High rating.
- ✗
High probability and low impact
Why it's wrong here
High probability with low impact yields a moderate rating under most qualitative matrices, since the two axes offset. This pairing is tempting because frequent occurrence feels severe, but likelihood alone does not raise impact; matrices reserve High for combinations where impact is also elevated.
- ✗
Low probability and high impact
Why it's wrong here
Low probability with high impact typically maps to Medium, because the rare likelihood tempers the severe consequence. This pairing is tempting since high impact sounds alarming, but qualitative matrices require both axes to contribute before assigning High.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.