Domain 2 · Objective reference 2A3 · Chapter 9 of 35
Assess risk with explicit methods and uncertainty
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Likelihood times impact is a model with assumptions.
Explore the anchors
Estimate event frequency or chance.
Concept matching activity
Match this task or description to its concept:
Estimate consequences for objectives.
Choose a concept before checking the explanation.
Risk-estimate sandbox
A fictional interruption costs the same amount per occurrence. Change the loss and expected annual frequency. This simplified annual loss expectancy model excludes uncertainty, correlated events and changing severity.
Annual loss expectancy = 10,000 × 2 = 20,000 units/year.
Ask what evidence supports both inputs. A precise arithmetic result does not make an uncertain estimate certain. Treatment cost alone is not the only decision criterion.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Assess likelihood and consequence
Management concept and decision mechanism
Describe an event, affected service, weakness and consequence before applying a score. Identify inherent exposure and the exposure after controls supported by evidence. Qualitative ratings depend on agreed definitions; multiplying ordinal labels does not automatically produce a financial measure. Quantitative estimates require credible inputs, time horizons and uncertainty. A simplified annual expected loss multiplies estimated loss per event by estimated events per year, but does not describe maximum loss or guarantee an annual bill. Compare scenarios and sensitivity with tolerance for severe outcomes, then communicate the decision implication.
Assess likelihood and consequence
Likelihood depends on the scenario and the relevant conditions, not just the existence of a vulnerability. Consider exposure, plausible threat activity, and how safeguards operate. Evaluate consequences for confidentiality, integrity, availability, and business objectives. An internet-facing service and an isolated laboratory system can have different exposure even when they share a software defect.
Use a defined rating scale with examples. Qualitative categories support comparison but are not precise probabilities. Quantitative estimates can be useful when evidence supports them; include ranges and uncertainty. Do not multiply ordinal labels and present the result as an objectively measured financial loss.
Worked example
A 200,000-unit loss and annual frequency of 0.2 give a simplified 40,000-unit expectation; the assessment also considers a severe outage beyond tolerance.
Check your understanding
Why can expected annual loss alone be insufficient?
Show explanation
It can conceal uncertainty, correlated events, unpriced effects and a severe consequence the business cannot tolerate.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.