Practice Test Geeks(CCP) Certified Cyber Professional Practice Test
← All CCP Flashcard Decks

Quantitative Risk Assessment Flashcards

7 cards from real CCP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.

Read the first 7 Quantitative Risk Assessment flashcards as text

  1. In quantitative risk assessment, what does 'risk aggregation' refer to?

    Answer: Combining individual risk estimates to understand total organizational risk exposure

    Risk aggregation combines individual risk estimates to provide a holistic view of total organizational risk exposure.

  2. A security team discovers that two risk scenarios are correlated — when one occurs, the other is more likely. How does this correlation affect quantitative risk modeling?

    Answer: Positive correlation increases aggregate risk beyond the sum of individual risks

    Positively correlated risks tend to occur together, amplifying aggregate losses beyond what independent risk summation would suggest.

  3. What is the purpose of sensitivity analysis in a quantitative cyber risk model?

    Answer: To determine which input variables have the greatest impact on the risk estimate

    Sensitivity analysis identifies which model inputs most significantly drive the output, helping prioritize data collection and control focus.

  4. An organization wants to quantify the risk of ransomware. They estimate $2M asset value, 30% EF, and 0.2 ARO. What is the ALE?

    Answer: $120,000

    SLE = $2M × 0.30 = $600,000; ALE = $600,000 × 0.2 = $120,000.

  5. In FAIR methodology, 'Threat Capability' is compared against 'Resistance Strength' to estimate:

    Answer: Vulnerability (probability of control failure)

    In FAIR, vulnerability is the probability that a threat actor's capability will overcome the resistance strength of controls.

  6. Which of the following best describes 'secondary loss' in a FAIR quantitative risk analysis?

    Answer: Losses from third parties such as regulatory fines, litigation, or reputational damage

    Secondary loss in FAIR refers to losses caused by secondary stakeholder responses, such as regulatory penalties, lawsuits, or customer churn.

  7. A risk model shows a 90th percentile loss of $1M and a 99th percentile loss of $8M. What does this gap suggest?

    Answer: There is significant tail risk with potential for catastrophic losses

    A large gap between percentile values indicates heavy tail risk — rare events can cause disproportionately severe losses.