CK Cyber 2 - LO1.3.E

What are the two main factors used in risk analysis according to EK-1.3.E.1?

• The cost of implementing security measures and the time required

• The likelihood of an attack and the severity of the projected damage

• The number of vulnerabilities and the type of threat

• The size of the organization and the number of employees

Which of the following is NOT a type of damage that an organization can suffer from an attack?

• Financial

• Operational

• Reputational

• Physical

What does qualitative risk analysis use to describe the risk of a vulnerability?

• Numeric values

• Descriptive terms

• Graphical representations

• Historical data

Which of the following is an example of a qualitative risk analysis term?

• High

What is an example of a quantitative risk analysis method?

• Describing risk as "unlikely low impact"

• Using terms like "severe" or "medium"

• Discussing potential reputational damage

Which of the following best describes a "likely high impact" risk?

• A risk that is unlikely to occur but would have a high impact if it did

• A risk that is likely to occur and would have a high impact

• A risk that is likely to occur but would have a low impact

• A risk that is unlikely to occur and would have a low impact

In quantitative risk analysis, what might a monetary value represent?

• The number of vulnerabilities in a system

• The potential financial loss from a risk

• The likelihood of an attack occurring

• The severity of reputational damage

Which of the following is an example of a scaled score used in quantitative risk analysis?

• Low

• Likely high impact

• Reputational

What type of risk analysis would use the term "severe" to describe a risk?

• Quantitative

• Qualitative

• Financial

• Operational

• Qualitative

• Quantitative

• Descriptive

• Reputational