CompTIA: Advanced Security Practitioner (CASP) Exam Prep

Answer - D - The approaches to risk analysis that have both pros and cons attached are quantitative and qualitative. Quantitative risk analysis attempts to assign real and meaningful numbers to all elements of the risk analysis process. These elements may include safeguard costs, asset value, business impact, frequency, safeguard effectiveness, and exploit possibilities. A major advantage to this method is that it applies actual numbers to elements of risk, while the major con is that it fails to quantify qualitative items that produce uncertainties in qualitative values.

Qualitative risk analysis does not assign numbers and monetary values. Instead, this method focuses on potential scenarios and ranking of threats and the possible countermeasures, based on opinions. The pro to this method is that it provides scenarios that may possibly be encountered, while the con is that there is not monetary value on elements.