Exam CS0-002 topic 1 question 365 discussion

CISO is primarily concerned with the legal liability and fines associated with data privacy. This indicates a focus on the potential consequences of data privacy breaches or non-compliance

Risk assessors evaluate the impact of a risk using a similar rating scale (high,medium,low). This evaluation should assume that a threat actually does take place and cause a risk to the organization and then attempt to identify the magnitude of the adverse impact that the risk will have on the organization. When evaluating this risk, it is helpful to refer to the three objectives of cybersecurity.

On exam

Quantitative probabilities involve using specific numerical values and data to assess the likelihood of events or incidents occurring. The goal of the risk assessment is to determine the probability of a threat occurs and its impact in the organization. Risk is assessed by factoring the likelihood of an event and the impact of the event. Likelihood is measured as a probability or percentage, while impact is expressed as a cost (dollar) value. Risk = Impact (or Magnitude) ($) x Likelihood (%)) RISK = PROBABILITY (%) x IMPACT(Magnitude) ($)

D only one that makes sense

Risk = Probability x Magnitude . strange question from Comptia. In reali life they will focus on Risk. Magnitude is not enough.

agree with kiduuu

Answer D

This question was on EXAM

Voting for C Where is the quantitative data to do a quantitative analysis. CISO is not looking for probability so A and B are out.

I agree with kiduuu, and other sources have D as well

Since the CISO is primarily concerned with the potential legal liability and fines associated with data privacy, the assessor will most likely focus on quantitative magnitude during the risk assessment. Quantitative magnitude focuses on the financial impact of a risk event or incident, which is relevant to the CISO's concerns about legal liability and fines. The assessor will need to determine the potential financial impact of data privacy risks to the organization, which can include regulatory fines, legal fees, and damages from civil lawsuits. The assessment will also need to consider the probability of the risk event occurring, but the emphasis will be on the financial impact to the organization