CompTIA Security+ (SY0-701)Security Program Management and OversightMedium
An analyst plots each identified risk on a chart using descriptive labels such as 'High,' 'Medium,' and 'Low' for both likelihood and impact, rather than assigning specific dollar values. Which risk assessment approach is being used?
- ASingle loss expectancy calculation
- BAnnualized loss expectancy calculation
- CQualitative analysis
- DQuantitative analysis
Show answer & explanationAnswer & explanation
Correct answer: C. Qualitative analysis
Qualitative risk analysis uses subjective, descriptive categories like High/Medium/Low instead of precise numerical or monetary values to rank risks.
Why the other options are wrong
- A. SLE is a quantitative monetary value representing loss from a single event.
- B. ALE is a specific quantitative metric calculated from SLE and ARO.
- D. Quantitative analysis uses numerical values such as dollar amounts and probabilities.
Qualitative Risk Analysis
A risk assessment method that uses descriptive, subjective categories (e.g., High/Medium/Low) rather than numeric values to rank likelihood and impact.
- Faster and less resource-intensive than quantitative analysis
- Relies on expert judgment and relative rankings
- Often combined with quantitative methods for a hybrid semi-quantitative approach
Memory trick: Qualitative = quick colors, Quantitative = quantities (numbers).