CCP Quantitative Risk Assessment 4

Question 1

In quantitative risk assessment, what does 'risk aggregation' refer to?

Accepted Answer

Combining individual risk estimates to understand total organizational risk exposure

Answer

Risk aggregation combines individual risk estimates to provide a holistic view of total organizational risk exposure.

Question 2

A security team discovers that two risk scenarios are correlated — when one occurs, the other is more likely. How does this correlation affect quantitative risk modeling?

Accepted Answer

Positive correlation increases aggregate risk beyond the sum of individual risks

Answer

Positively correlated risks tend to occur together, amplifying aggregate losses beyond what independent risk summation would suggest.

Question 3

What is the purpose of sensitivity analysis in a quantitative cyber risk model?

Accepted Answer

To determine which input variables have the greatest impact on the risk estimate

Answer

Sensitivity analysis identifies which model inputs most significantly drive the output, helping prioritize data collection and control focus.

Question 4

An organization wants to quantify the risk of ransomware. They estimate $2M asset value, 30% EF, and 0.2 ARO. What is the ALE?

Accepted Answer

$120,000

Answer

SLE = $2M × 0.30 = $600,000; ALE = $600,000 × 0.2 = $120,000.

Question 5

In FAIR methodology, 'Threat Capability' is compared against 'Resistance Strength' to estimate:

Accepted Answer

Vulnerability (probability of control failure)

Answer

In FAIR, vulnerability is the probability that a threat actor's capability will overcome the resistance strength of controls.

(CCP) Certified Cyber Professional Practice Test

(CCP) Certified Cyber Professional Practice Test

CCP Quantitative Risk Assessment 4