CompTIA Security+ (SY0-701)Security Program Management and OversightHard
A risk analyst creates a visual chart plotting each identified risk according to its likelihood on one axis and its impact on the other, using color coding (green, yellow, red) to indicate severity levels. What is this tool called?
- ARisk matrix
- BBusiness impact analysis
- CAttack surface map
- DRisk register
Show answer & explanationAnswer & explanation
Correct answer: A. Risk matrix
A risk matrix (also called a heat map) is a visual tool that plots risks by likelihood and impact, often using color coding to quickly communicate relative severity, aiding prioritization decisions.
Why the other options are wrong
- B. A business impact analysis identifies critical processes and downtime tolerances, not a likelihood/impact chart.
- C. An attack surface map documents exposed systems and entry points, unrelated to risk severity visualization.
- D. A risk register is a comprehensive log of all risks with details like owners and status, not primarily a visual likelihood/impact chart.
Risk Matrix (Heat Map)
A visual tool that plots risks based on likelihood and impact, often using color coding, to help prioritize which risks require the most attention.
- Commonly uses a grid with likelihood on one axis and impact on the other
- Color coding (green/yellow/red) communicates severity at a glance
- Complements the risk register by visualizing qualitative risk data
Memory trick: Matrix = map of likelihood x impact, colored like a traffic light