SY0-701 · Objective 5.2 · Security Program Management and Oversight
5.2 Risk management explained
The official objective: “Explain elements of the risk management process.” Here is what it means, what candidates mix up, and 3 practice questions that test it.
What objective 5.2 covers
Objective 5.2 covers the risk management process from start to finish, with a few calculations the exam likes to test.
Risk identification finds what could go wrong. Risk assessment can be ad hoc (done when something changes), recurring, one-time or continuous. Risk analysis then measures each risk. Qualitative analysis uses ratings such as low, medium and high for likelihood and impact, often plotted on a colour-coded matrix. Quantitative analysis uses numbers. The single loss expectancy (SLE) is the cost of one occurrence: asset value multiplied by exposure factor, the percentage of the asset lost. The annualised rate of occurrence (ARO) is how many times a year it is expected. The annualised loss expectancy (ALE) is SLE multiplied by ARO, which gives a yearly figure you can compare with the cost of a control. For example, a $200,000 asset that would lose 25 percent of its value has an SLE of $50,000; if that happens twice a year, the ALE is $100,000.
The risk register records each risk with its description, owner, likelihood and impact, chosen response, key risk indicators and current status. The risk owner is the person accountable for tracking it and making sure treatment happens. Risk threshold is the level at which a risk must be escalated.
Risk appetite is how much risk an organisation is willing to take in pursuit of its goals, described as expansionary, conservative or neutral. Risk tolerance is the acceptable variation around that, often stated as a specific limit. After controls are applied, what remains is residual risk; it should sit within the appetite.
There are four risk responses. Transfer moves the financial impact to someone else, such as an insurer. Accept means knowingly living with the risk, sometimes through a formal exemption or exception. Avoid means stopping the activity that creates the risk. Mitigate means adding controls to reduce it. Risk reporting tells leadership where things stand.
Business impact analysis identifies critical functions and how quickly they must come back. The recovery time objective (RTO) is the maximum acceptable time to restore a service. The recovery point objective (RPO) is the maximum acceptable data loss, measured backwards in time. Mean time to repair (MTTR) is the average time to fix a failure. Mean time between failures (MTBF) is the average time a repairable system runs before it fails again.
What candidates mix up
- SLE versus ALE: SLE is one event; ALE is the yearly expected loss (SLE multiplied by ARO).
- Risk appetite versus risk tolerance: appetite is the overall willingness to take risk; tolerance is the acceptable deviation from it.
- Inherent versus residual risk: inherent is before controls; residual is what's left after them.
- RTO versus RPO: RTO is downtime allowed; RPO is data loss allowed.
Practice questions for 5.2
From the CertRidge SY0-701 question bank. Try each one before opening the answer.
Question 1
A risk analyst estimates that a single occurrence of a threat would cost $40,000 (SLE) and that the threat is expected to occur twice per year (ARO = 2). The organization will compare the annualized loss expectancy (ALE) with the yearly cost of a proposed control. What is the ALE?
- A$80,000 per year, calculated as SLE multiplied by ARO
- B$20,000 per year, calculated as SLE divided by ARO
- C$40,000 per year, because ALE equals the SLE value
- D$160,000 per year, calculated as SLE multiplied by ARO squared
Show answer and explanation
Answer: A) $80,000 per year, calculated as SLE multiplied by ARO
ALE = SLE × ARO, so $40,000 × 2 = $80,000 per year. Organizations compare this figure with a control's annual cost to decide whether mitigation is cost-effective.
- ACorrect. ALE = SLE × ARO = $40,000 × 2 = $80,000. A control is cost-justified if its annual cost is less than the reduction in ALE it achieves.
- BIncorrect. ALE multiplies SLE by ARO. Dividing understates the expected yearly loss.
- CIncorrect. $40,000 is the loss from a single occurrence. ALE must account for how many times per year the event is expected to occur.
- DIncorrect. ARO is applied once, not squared. Squaring it doubles the expected loss and could justify overspending on controls.
Question 2
After applying controls to a high risk, the organization documents the remaining exposure that stays even with those controls in place. What is this remaining exposure called, and against what is it compared to decide whether to accept it?
- AResidual risk, compared against the organization's risk appetite/tolerance
- BInherent risk, compared against the annual budget
- CTotal risk, compared against competitors
- DZero risk, since controls were applied
Show answer and explanation
Answer: A) Residual risk, compared against the organization's risk appetite/tolerance
- AResidual risk is what's left after mitigation; leadership accepts it only if it falls within the defined risk appetite, otherwise further treatment is required.
- BInherent risk is the exposure before any controls, and budget isn't the acceptance criterion.
- CRisk acceptance is judged against the organization's own tolerance, not peers.
- DControls reduce but rarely eliminate risk; assuming zero is a common and dangerous error.
Question 3
A startup's board approves a statement saying the company will tolerate more security risk than its industry peers if doing so lets it launch products sooner and win new customers. Which risk appetite does this statement reflect?
- AExpansionary
- BConservative
- CNeutral
- DResidual
Show answer and explanation
Answer: A) Expansionary
An organization that knowingly accepts more risk to grow faster has an expansionary risk appetite. Conservative appetites keep risk low, and neutral appetites balance risk against reward.
- ACorrect. An expansionary risk appetite means willingly accepting more risk in pursuit of growth and new opportunities, which is what the board describes.
- BIncorrect. A conservative appetite tries to keep risk low and passes on uncertain opportunities. That is the opposite of tolerating more risk than peers.
- CIncorrect. A neutral appetite balances risk against reward without leaning either way. The board is clearly leaning toward taking on more risk.
- DIncorrect. Residual risk is the risk left after controls are applied. It describes a level of risk, not how willing an organization is to take risk.
Other Security Program Management and Oversight objectives
Also: the Security Program Management and Oversight domain page (20% of the exam), all SY0-701 objectives and the SY0-701 cheat sheet.
Ready for a full SY0-701 practice exam?
Timed practice exams match the real exam's length and domain weights, every result shows your score per domain, and Review Mode re-drills the questions you missed.
Objective numbers and statements from CompTIA's published SY0-701 exam objectives. The explanations and questions are our own. Not affiliated with CompTIA.