A risk analyst compares two threats. Phishing attempts land several times a month, and each costs about an hour of help-desk time. A regional flood is expected roughly once in 20 years, but it would shut down the primary data center for weeks. The analyst marks the flood as negligible because it is rare. What is wrong with that ranking?
Select an answer to reveal the explanation.
Short Explanation
Think of it like home insurance: your house probably won't burn down this year, but you still insure it because the hit would be enormous. Ranking a threat means weighing how likely it is AND how bad it would be. The trap is letting "rare" automatically mean "unimportant" -- you've got to look at the impact side too.
Full Explanation
Threat ranking combines two characteristics: likelihood, meaning how probable or frequent the event is, and impact, meaning the harm it would cause to operations, finances, safety or reputation. A common qualitative approach plots both on a matrix, and a quantitative approach multiplies loss per event by expected frequency. Either way, a low-likelihood, high-impact event can carry as much or more risk than a frequent nuisance. Treating frequency as the only factor reverses the error rather than correcting it; the phishing threat is important, but its per-event impact is small, so frequency alone cannot settle the ranking. Excluding natural disasters from security risk work is incorrect because availability is part of the security triad, and environmental threats appear in business impact analysis and continuity planning. Requiring a measured dollar loss before ranking is also wrong: qualitative scales such as low, medium and high are legitimate when hard numbers are unavailable. On the exam, watch for answers that collapse risk into a single dimension. Operational check: confirm that every register entry records both a likelihood rating and an impact rating, and that the combined score, not either factor alone, drives the treatment order.