(ISC)2 Certified in Cybersecurity Practice Exam

What two factors are used to evaluate a risk?

1. Cost and Benefit

2. Likelihood and Impact

3. Threat and Vulnerability

4. Exposure and Response

The correct answer is: Likelihood and Impact

The evaluation of risk in cybersecurity primarily involves assessing two key factors: likelihood and impact. Likelihood refers to the probability that a particular threat will exploit a vulnerability and result in a negative event. This assessment helps organizations understand how probable it is that a specific risk could materialize in their environment. Impact, on the other hand, assesses the potential consequences of that risk if it does occur. Evaluating impact involves considering the possible damage to assets, operations, finances, reputation, and compliance obligations that could result from an incident. By combining these two factors, organizations can prioritize risks based on their severity and take appropriate measures to mitigate them. Understanding both how likely a risk is to occur and the severity of its consequences enables a more comprehensive approach to risk management, aiding in resource allocation and strategic planning. This makes likelihood and impact essential components in the risk assessment process.