Management wants a quick ranking of the top risks in a new multi-cloud environment so it can prioritize funding next quarter. The organization has little reliable historical loss data for cloud incidents. Which risk analysis approach is most appropriate?
Select an answer to reveal the explanation.
Short Explanation
When you don't have solid loss numbers, trying to compute dollar figures is like guessing your gas mileage without a fuel gauge. Qualitative analysis uses agreed scales, such as low, medium and high, to rank risks quickly and consistently. It's the right tool when speed matters and the data's thin.
Full Explanation
Qualitative risk analysis evaluates likelihood and impact using descriptive or ordinal scales defined in advance, often combined in a heat map, to rank risks relative to one another. It relies on expert judgment and structured input from stakeholders, so it can be completed quickly and works well when reliable historical loss data are scarce, which matches both constraints in the scenario. Quantitative analysis calculates monetary values such as single loss expectancy and annualized loss expectancy, but its precision is only as good as its inputs; without trustworthy incident cost history it produces numbers that look exact while resting on guesses. Penetration testing identifies exploitable technical weaknesses, which feeds risk assessment, but counting findings ignores business impact and threat likelihood and would take far longer than a quick ranking allows. SLA service credits are commercial remedies capped by contract and bear little relation to the organization's actual business losses during an outage, so using them as loss expectancy would systematically understate impact. Exam caveat: organizations frequently use qualitative ranking first and then apply quantitative analysis to the highest risks where data allow. Operational check: confirm the likelihood and impact scales are documented and that the risk owners reviewed the resulting rankings.