Qualitative Risk Analysis: Matrix Rating for High Probability and Medium Impact
In a qualitative risk analysis, a risk is assigned a probability of 'High' and an impact of 'Medium'. According to common probability/impact matrices, what is the overall risk rating?
Quick Answer
A High probability combined with a Medium impact typically produces an overall High risk rating because qualitative risk matrices are built so that an elevated value in either dimension pulls the overall rating upward, not just a simultaneous elevation in both. The logic behind this design is that a risk with high likelihood deserves serious attention even if its individual impact isn't the worst-case scenario, since something that's likely to happen repeatedly or frequently accumulates organizational cost and disruption over time in a way a low-probability, high-impact event might not. Probability and impact matrices, whether a simple 3x3 grid or a more granular 5x5 grid used in frameworks like NIST SP 800-30 or ISO 31000, are structured as a lookup table where each combination of probability and impact levels maps to a predefined overall rating, and in most common versions of these matrices, a High and Medium combination lands in the High category rather than a lower Medium rating, only when both probability and impact are lower does the overall rating drop to Medium or Low. This is why qualitative risk analysis can't be reduced to simple averaging; it follows the matrix's specific mapping rules instead. When a question gives you a probability and impact level and asks for the overall rating, think in terms of the matrix's typical bias toward the higher of the two inputs rather than assuming a strict midpoint.
⚠ Common exam trap
Candidates often confuse 'High' probability with 'Critical' overall rating, or incorrectly assume that a 'Medium' impact automatically lowers the rating to 'Medium', ignoring that the probability weight dominates in many matrix designs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
High
In a standard qualitative risk analysis probability/impact matrix, a 'High' probability combined with a 'Medium' impact typically yields an overall risk rating of 'High'. This is because the matrix is designed to prioritize risks where both factors are elevated, and the product or intersection of these two values falls into the 'High' category in most common 3x3 or 5x5 matrices used in frameworks like NIST SP 800-30 or ISO 31000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
High
Why this is correct
High probability combined with medium impact yields High risk in most matrices.
- ✗
Critical
Why it's wrong here
Critical usually requires both High probability and High impact.
- ✗
Medium
Why it's wrong here
Medium would require at least one factor medium or low.
- ✗
Low
Why it's wrong here
Low would require both probability and impact low.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 920-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. During a qualitative risk analysis, an organization assigns a risk rating of 'High' for a specific threat. Which combination of factors most directly leads to this rating?
medium- ✓ A.High probability and high impact
- B.Low probability and low impact
- C.High probability and low impact
- D.Low probability and high impact
Why A: In qualitative risk analysis, risk rating is determined by the product of probability and impact. A 'High' rating directly results from both high probability and high impact, as this combination represents the greatest potential for loss. This aligns with the risk matrix approach where the highest risk scores occupy the top-right quadrant.
Variation 2. During a qualitative risk analysis, an organization rates the likelihood of a flood as 'Low' and the impact as 'High'. Using a standard 3x3 risk matrix, what is the overall risk rating?
easy- A.High
- B.Critical
- ✓ C.Medium
- D.Low
Why C: In a standard 3x3 risk matrix, the overall risk rating is derived by combining the likelihood and impact ratings. With likelihood rated as 'Low' and impact as 'High', the intersection in the matrix typically yields a 'Medium' risk rating. This is because the matrix is designed to balance low probability events with high consequences, resulting in a moderate overall risk level.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.