Study. uk . com
  1. Home
  2. All questions
  3. Question 27

CompTIA Security+ study material · question 27 of 611

An organisation has no reliable loss data for a new class of risk and needs a ranking quickly. Which approach fits, and what is its main limitation?

  1. Qualitative analysis; it requires exposure factors for every asset
  2. Quantitative analysis; it requires an external auditor
  3. Qualitative analysis; the ordinal ratings cannot be summed
  4. Quantitative analysis; the results cannot be compared across risks
Show the answer

Answer: C. Qualitative analysis; the ordinal ratings cannot be summed

Qualitative scales work without loss data but produce rankings, not values that can be added or compared to control cost.

Source: NIST SP 800-30 Rev. 1 (NIST) — SP 800-30 Rev. 1 § 2.3.2 Assessment Approaches

Challenge yourself on this topic → Study as cards