Risk assessment methodologies in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of risk assessment in cybersecurity?

The main purpose is to identify, evaluate, and prioritize risks to protect information and systems from threats and vulnerabilities.

beginner

What are the two primary types of risk assessment methodologies?

Qualitative and quantitative risk assessments. Qualitative uses descriptive terms, while quantitative uses numbers and data.

beginner

Explain the qualitative risk assessment approach.

It uses categories like high, medium, and low to describe risk levels based on expert judgment and experience without exact numbers.

intermediate

What does a quantitative risk assessment involve?

It involves calculating numerical values for risk, often using formulas to estimate the likelihood and impact of threats.

intermediate

Why is it important to choose the right risk assessment methodology?

Choosing the right method helps organizations understand risks clearly and make better decisions to protect assets effectively.

Which risk assessment method uses descriptive terms like 'high' or 'low'?

A Statistical

B Quantitative

C Qualitative

D Mathematical

Qualitative risk assessment uses descriptive categories to express risk levels.

What does quantitative risk assessment primarily rely on?

A General descriptions

B Expert opinions

C Guesswork

D Numerical data and calculations

Quantitative risk assessment uses numbers and formulas to estimate risk.

Why is risk assessment important in cybersecurity?

A To identify and prioritize risks

B To reduce system speed

C To increase system complexity

D To ignore threats

Risk assessment helps identify and prioritize risks to protect systems.

Which of the following is NOT a typical step in risk assessment?

A Ignoring vulnerabilities

B Evaluating risks

C Identifying assets

D Prioritizing risks

Ignoring vulnerabilities is not part of risk assessment; they must be considered.

What is a key benefit of using quantitative risk assessment?

A It avoids numbers

B It provides exact risk values

C It uses only opinions

D It ignores impact

Quantitative assessment provides numerical values to help measure risk precisely.

Describe the difference between qualitative and quantitative risk assessment methodologies.

Think about how risks are expressed in words versus numbers.

Explain why performing a risk assessment is important for an organization’s cybersecurity.

Consider how understanding risks helps protect assets.