TechKnowSurge
CompTIA Security+ 5.2
TechKnowSurge Catalog Interactives Quantitative or Qualitative?
InteractiveSecurityFree

Quantitative or Qualitative?

A 5% chance of a $400,000 loss, or a risk rated likely and major? Sort each analysis, one at a time.

⚑ Complete this interactive to capture a CTF flag worth 5 points.

About this interactive

Once the risks are on a list, risk analysis works out how deep each one goes, so the top risk stands out. The Risk Analysis lesson describes two forms. Quantitative analysis deals in quantities. Probability is a percent and impact is a dollar amount, and multiplying them gives a dollar figure for the risk: a 10% chance of a $100,000 loss is a $10,000 risk. Annualized loss expectancy is the same idea worked out per year. Qualitative analysis rates instead of measuring. Likelihood is rated rare, unlikely, possible, likely or certain; impact negligible, minor, moderate, major or severe; or simply low, medium and high. A risk matrix combines the two ratings into a level. The lesson also separates two words: probability is a number you assign, likelihood is a rating. Most people use them interchangeably. One trap: a rating scale written as numbers, such as likelihood 4 on a 1 to 5 scale, is still qualitative in Security+ terms, because the 4 is a rating, not a measured percent or dollar amount. The lesson's presenter argues those ratings are really quantitative; Security+ and this activity follow the standard usage.

What you'll learn

Aligned to

CompTIA Security+
5.2 Explain elements of the risk management process

Key terms

Quantitative Risk Analysis
A risk analysis method that assigns numerical values — such as probability percentages and monetary loss estimates — to risks in order to prioritize them and justify the cost of controls. It produces metrics like Single Loss Expectancy and Annualized Loss Expectancy.
Qualitative Risk Analysis
A risk analysis method that uses descriptive ratings such as low, medium, or high to assess the likelihood and impact of risks without assigning specific monetary values.
Likelihood
A descriptive rating used in qualitative risk analysis to estimate how probable it is that a risk event will occur, typically expressed as low, medium, or high.
Impact
The potential consequence or damage to an organization if a risk event occurs, expressed qualitatively or as a monetary value.
Risk Matrix
A grid used in qualitative risk analysis that maps likelihood against impact to prioritize risks and determine which require the most urgent attention.

Topics

Risk Analysis Risk Assessment Interactive Streak Sort

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →