Quantitative/Qualitative Risk and BIA

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

Quantitative/Qualitative Risk and BIA

Key Takeaways Explain This Topic AI

Qualitative risk analysis uses categories such as low, medium, high, and critical.

Quantitative risk analysis uses numeric estimates: AV, EF, SLE, ARO, and ALE.

SLE = AV x EF and ALE = SLE x ARO are the two formulas you must memorize for SY0-701.

A business impact analysis identifies critical processes, dependencies, MTD/MTTR, RTO, and RPO.

RTO is the target time to restore a function; RPO is the acceptable amount of data loss measured in time.

Last updated: June 2026

Two Ways to Measure Risk

Risk analysis compares uncertainty and business impact. SY0-701 expects both the qualitative and quantitative approaches, plus how a business impact analysis (BIA) drives continuity and recovery decisions. Calculation items are some of the few math questions on the exam, and they are easy points if you memorize two formulas.

Qualitative Risk

Qualitative analysis uses descriptive ratings – useful when exact numbers are unavailable or leadership needs a fast comparison. It is faster and cheaper than quantitative analysis but inherently subjective, because the labels depend on the judgment of the people scoring them. Most enterprises start with qualitative scoring to triage and then apply quantitative analysis only to the highest-rated items, where the cost of detailed data collection is justified.

The exam wants you to recognize that neither method is "better" in the abstract: qualitative is appropriate for broad, fast prioritization, while quantitative is appropriate when a dollar figure is needed to justify spending to leadership.

• Likelihood Impact Qualitative risk
• Low Low Low
• High Low Medium
• Low High Medium
• High High High or critical

Ratings must still be defined. If "high impact" means different things to different teams, prioritization becomes inconsistent. A documented likelihood-by-impact matrix (a risk heat map ) keeps scoring repeatable.

Quantitative Risk – Memorize These

• Term Meaning Formula or example
• AV (asset value) Dollar value of the asset Payment system valued at 500000
• EF (exposure factor) Percentage of asset value lost in one event 20 percent loss = 0.20
• SLE (single loss expectancy) Expected loss from one event SLE = AV x EF
• ARO (annualized rate of occurrence) Expected frequency per year Once every 2 years = 0.5
• ALE (annualized loss expectancy) Expected loss per year ALE = SLE x ARO

The two formulas you cannot forget: SLE = AV x EF and ALE = SLE x ARO . Watch the ARO conversion – "once every 4 years" is 0.25, and "three times per year" is 3.

Worked Quantitative Example

A warehouse management system is valued at 400000. A ransomware event is estimated to destroy 35 percent of its value and is expected once every 4 years.

• Calculation Result
• AV 400000
• EF 0.35
• SLE = AV x EF 140000
• ARO (once per 4 years) 0.25
• ALE = SLE x ARO 35000

If a backup-and-recovery improvement costs 18000 per year and cuts the ALE to 10000, the expected annual risk reduction is 25000 against an 18000 cost – a defensible 7000 net benefit. The number does not force the purchase, but it gives leadership an evidence-based comparison.

Business Impact Analysis

A BIA identifies critical business processes, their dependencies, and the impact of disruption, then sets recovery priorities. SY0-701 tests the recovery metrics relentlessly.

• BIA term Meaning Example
• Critical business function Process that must be restored quickly Order fulfillment
• Dependency System, vendor, staff, facility, or data needed Inventory DB + shipping API
• MTD (maximum tolerable downtime) Longest disruption the business can survive 24 hours
• RTO (recovery time objective) Target time to restore service Restore order system within 4 hours
• RPO (recovery point objective) Acceptable data loss measured in time Lose no more than 15 minutes of orders
• MTBF (mean time between failures) Average uptime between failures of a device 50000 hours
• MTTR (mean time to repair) Average time to restore a failed device 4 hours

The classic exam trap is RTO vs RPO . RTO is about time to recover (forward-looking, how long the function can be down). RPO is about data loss (backward-looking, how far back you must restore from). A simple way to keep them straight: RTO is measured forward from the moment of the outage to the moment service returns; RPO is measured backward from the outage to the last good backup. An RPO of 15 minutes means backups or replication must run at least every 15 minutes, so continuous replication is needed for very low RPOs while nightly tape backups imply an RPO closer to 24 hours.

MTBF (mean time between failures) and MTTR (mean time to repair) describe hardware reliability and repairability – how often a device fails and how long it takes to fix – and are easy distractors against the recovery objectives. The MTD caps everything: if a function's MTD is 24 hours, no recovery plan with an RTO above 24 hours is acceptable.

Scenario: Choosing Recovery Priorities

After a regional outage the team can restore only two systems in the first hour.

• System BIA result Priority
• Payment processing RTO 1 hr, RPO 5 min, high revenue impact Restore first
• Warehouse routing RTO 2 hr, RPO 15 min, high fulfillment impact Restore second
• Public blog RTO 3 days, RPO 24 hr, low impact Restore later
• HR training archive RTO 5 days, RPO 48 hr, low immediate impact Restore later

The BIA prevents recovery decisions driven only by who complains loudest.

Common Traps

Confusing RTO (time) with RPO (data loss).

Treating quantitative estimates as exact when they are still assumptions.

Using qualitative labels without defining them.

Ignoring dependencies such as vendors, facilities, and staff.

Confusing MTBF/MTTR (device reliability) with RTO/RPO (recovery objectives).

Exam Focus

For calculations: SLE = AV x EF and ALE = SLE x ARO , and convert ARO carefully. For continuity: RTO = restoration time, RPO = acceptable data loss in time, MTD = the outer limit . If a question gives a backup frequency, it maps to RPO; if it gives a restore deadline, it maps to RTO.