BCS CISMP-V9 Exam - Topic 2 Question 101 Discussion

Actual exam question for BCS's CISMP-V9 exam

Question #: 101
Topic #: 2

[All CISMP-V9 Questions]

When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

ARisk = Likelihood * Impact.

BRisk = Likelihood / Impact.

CRisk = Vulnerability / Threat.

DRisk = Threat * Likelihood.

Show Suggested Answer

Suggested Answer: A

In the context of information security, risk is typically calculated as the product of likelihood and impact. This formula encapsulates the probability of a vulnerability being exploited (likelihood) and the potential damage or loss that could result from such an event (impact). The goal is to quantify the level of risk in order to prioritize mitigation efforts effectively. Options B, C, and D do not represent standard risk calculation formulas in information security management.

by Winfred at Jul 10, 2025, 12:53 PM

Limited Time Offer

25%

Off

Get Premium CISMP-V9 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leota

2 months ago

A seems right, but I've seen different interpretations out there.

upvoted 0 times

...

Leana

2 months ago

I thought it was D, Risk = Threat * Likelihood.

upvoted 0 times

...

Kathrine

2 months ago

Wait, isn't it more complicated than that?

upvoted 0 times

...

Elza

3 months ago

It's definitely A, Risk = Likelihood * Impact.

upvoted 0 times

...

Clement

3 months ago

Totally agree with A! That's the standard formula.

upvoted 0 times

...

Arlyne

3 months ago

I thought Risk was calculated differently, maybe involving Threat somehow, but I can't recall the exact formula.

upvoted 0 times

...

Carli

3 months ago

I feel like I might be mixing up the terms. Wasn't there something about Threat and Vulnerability in another practice question?

upvoted 0 times

...

Dyan

4 months ago

I remember practicing a question similar to this, and I think option A was the correct answer. It makes sense to multiply those two factors.

upvoted 0 times

...

Justine

4 months ago

I think the formula is Risk = Likelihood * Impact, but I'm not completely sure if that's the right way to express it.

upvoted 0 times

...

Ilda

4 months ago

I've got this one! Risk is calculated by multiplying the likelihood of the vulnerability being exploited by the potential impact. So the answer is definitely A.

upvoted 0 times

...

Nettie

4 months ago

I'm a bit confused by this question. The options don't seem to match what I learned about risk assessment. I'll have to review my notes to make sure I understand the right formula.

upvoted 0 times

...

Kanisha

4 months ago

Okay, let me walk through this step-by-step. The question is asking how risk is calculated when a vulnerability is exploited. I remember from the lectures that risk is a function of likelihood and impact, so I think the answer is A.

upvoted 0 times

...

Truman

5 months ago

Hmm, I'm a little unsure about this one. I know risk has something to do with likelihood and impact, but I can't remember the exact formula. I'll have to think it through carefully.

upvoted 0 times

...

Ernest

5 months ago

I'm pretty sure the answer is A. Risk is calculated by multiplying the likelihood of the vulnerability being exploited by the impact it would have.

upvoted 0 times

...

Olive

6 months ago

Haha, I bet the answer is A. Gotta love those classic 'likelihood times impact' risk equations. Works every time!

upvoted 0 times

...

Herschel

6 months ago

C is just weird. Vulnerability and threat are separate factors, not how you calculate the overall risk.

upvoted 0 times

...

Pearlene

6 months ago

Hmm, B doesn't make much sense to me. Risk is proportional to likelihood and impact, not inversely related.

upvoted 0 times

Rozella

5 months ago

So, it's important to assess both factors when calculating risk.

upvoted 0 times

...

Winfred

5 months ago

Definitely, the risk is higher when likelihood and impact are both high.

upvoted 0 times

...

Sommer

5 months ago

I agree, B doesn't seem right. It should be A.

upvoted 0 times

...

Luisa

5 months ago

A) Risk = Likelihood * Impact.

upvoted 0 times

...

Brice

7 months ago

No, I remember studying that it's Risk = Likelihood * Impact in our exam prep materials.

upvoted 0 times

...

Rosendo

7 months ago

I'm gonna go with D. Threat and likelihood go hand-in-hand when it comes to risk, right? Can't have one without the other.

upvoted 0 times

Nidia

5 months ago

User 2: I agree with Nidia. A seems like the correct formula to calculate risk.

upvoted 0 times

...

Skye

5 months ago

User 2: I agree with Skye. A seems like the correct formula to calculate risk.

upvoted 0 times

...

Viva

5 months ago

User 1: I think the answer is A. Likelihood and impact are key factors in calculating risk.

upvoted 0 times

...

Karl

5 months ago

User 1: I think the answer is A. Likelihood and impact are key factors in calculating risk.

upvoted 0 times

...

Daryl

7 months ago

I'm not sure, but I think it might be Risk = Threat * Likelihood.

upvoted 0 times

...

Rosio

7 months ago

I agree with Brice, it makes sense that the risk would be Likelihood * Impact.

upvoted 0 times

...

Dion

7 months ago

Duh, it's obviously A. Likelihood and impact are the two key factors in calculating risk. Seems pretty straightforward to me.

upvoted 0 times

Rocco

6 months ago

User 2: Yeah, it makes sense. A seems like the correct formula to use.

upvoted 0 times

...

Alpha

7 months ago

User 1: I agree, it's definitely A. Likelihood and impact play a big role in calculating risk.

upvoted 0 times

...

Brice

7 months ago

I think the risk is calculated by multiplying the likelihood and impact.

upvoted 0 times

...