BCS CISMP-V9 Exam - Topic 2 Question 101 Discussion

Actual exam question for BCS's CISMP-V9 exam

Question #: 101
Topic #: 2

[All CISMP-V9 Questions]

When calculating the risk associated with a vulnerability being exploited, how is this risk calculated?

ARisk = Likelihood * Impact.

BRisk = Likelihood / Impact.

CRisk = Vulnerability / Threat.

DRisk = Threat * Likelihood.

Show Suggested Answer

Suggested Answer: A

In the context of information security, risk is typically calculated as the product of likelihood and impact. This formula encapsulates the probability of a vulnerability being exploited (likelihood) and the potential damage or loss that could result from such an event (impact). The goal is to quantify the level of risk in order to prioritize mitigation efforts effectively. Options B, C, and D do not represent standard risk calculation formulas in information security management.

by Winfred at Jul 10, 2025, 12:53 PM

Limited Time Offer

25%

Off

Get Premium CISMP-V9 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Leota

9 months ago

A seems right, but I've seen different interpretations out there.

upvoted 0 times

...

Leana

9 months ago

I thought it was D, Risk = Threat * Likelihood.

upvoted 0 times

...

Kathrine

9 months ago

Wait, isn't it more complicated than that?

upvoted 0 times

...

Elza

10 months ago

It's definitely A, Risk = Likelihood * Impact.

upvoted 0 times

...

Clement

10 months ago

Totally agree with A! That's the standard formula.

upvoted 0 times

...

Arlyne

10 months ago

I thought Risk was calculated differently, maybe involving Threat somehow, but I can't recall the exact formula.

upvoted 0 times

...

Carli

10 months ago

I feel like I might be mixing up the terms. Wasn't there something about Threat and Vulnerability in another practice question?

upvoted 0 times

...

Dyan

10 months ago

I remember practicing a question similar to this, and I think option A was the correct answer. It makes sense to multiply those two factors.

upvoted 0 times

...

Justine

11 months ago

I think the formula is Risk = Likelihood * Impact, but I'm not completely sure if that's the right way to express it.

upvoted 0 times

...

Ilda

11 months ago

I've got this one! Risk is calculated by multiplying the likelihood of the vulnerability being exploited by the potential impact. So the answer is definitely A.

upvoted 0 times

...

Nettie

11 months ago

I'm a bit confused by this question. The options don't seem to match what I learned about risk assessment. I'll have to review my notes to make sure I understand the right formula.

upvoted 0 times

...

Kanisha

11 months ago

Okay, let me walk through this step-by-step. The question is asking how risk is calculated when a vulnerability is exploited. I remember from the lectures that risk is a function of likelihood and impact, so I think the answer is A.

upvoted 0 times

...

Truman

11 months ago

Hmm, I'm a little unsure about this one. I know risk has something to do with likelihood and impact, but I can't remember the exact formula. I'll have to think it through carefully.

upvoted 0 times

...

Ernest

12 months ago

I'm pretty sure the answer is A. Risk is calculated by multiplying the likelihood of the vulnerability being exploited by the impact it would have.

upvoted 0 times

...

Olive

1 year ago

Haha, I bet the answer is A. Gotta love those classic 'likelihood times impact' risk equations. Works every time!

upvoted 0 times

...

Herschel

1 year ago

C is just weird. Vulnerability and threat are separate factors, not how you calculate the overall risk.

upvoted 0 times

...

Pearlene

1 year ago

Hmm, B doesn't make much sense to me. Risk is proportional to likelihood and impact, not inversely related.

upvoted 0 times

Rozella

12 months ago

So, it's important to assess both factors when calculating risk.

upvoted 0 times

...

Winfred

1 year ago

Definitely, the risk is higher when likelihood and impact are both high.

upvoted 0 times

...

Sommer

1 year ago

I agree, B doesn't seem right. It should be A.

upvoted 0 times

...

Luisa

1 year ago

A) Risk = Likelihood * Impact.

upvoted 0 times

...

Brice

1 year ago

No, I remember studying that it's Risk = Likelihood * Impact in our exam prep materials.

upvoted 0 times

...

Rosendo

1 year ago

I'm gonna go with D. Threat and likelihood go hand-in-hand when it comes to risk, right? Can't have one without the other.

upvoted 0 times

Nidia

12 months ago

User 2: I agree with Nidia. A seems like the correct formula to calculate risk.

upvoted 0 times

...

Skye

12 months ago

User 2: I agree with Skye. A seems like the correct formula to calculate risk.

upvoted 0 times

...

Viva

1 year ago

User 1: I think the answer is A. Likelihood and impact are key factors in calculating risk.

upvoted 0 times

...

Karl

1 year ago

User 1: I think the answer is A. Likelihood and impact are key factors in calculating risk.

upvoted 0 times

...

Daryl

1 year ago

I'm not sure, but I think it might be Risk = Threat * Likelihood.

upvoted 0 times

...

Rosio

1 year ago

I agree with Brice, it makes sense that the risk would be Likelihood * Impact.

upvoted 0 times

...

Dion

1 year ago

Duh, it's obviously A. Likelihood and impact are the two key factors in calculating risk. Seems pretty straightforward to me.

upvoted 0 times

Rocco

1 year ago

User 2: Yeah, it makes sense. A seems like the correct formula to use.

upvoted 0 times

...

Alpha

1 year ago

User 1: I agree, it's definitely A. Likelihood and impact play a big role in calculating risk.

upvoted 0 times

...

Brice

1 year ago

I think the risk is calculated by multiplying the likelihood and impact.

upvoted 0 times

...