I85PREP
⌘ K
Open FAIR 2 Foundation study materials
Open FAIR 2 Foundation study resources

Open FAIR 2 Foundation practice questions

One question at a time. Build your Open FAIR 2 Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Open FAIR risk analysis concepts and terminology

In Open FAIR analysis, which statement best defines risk itself?

  1. The total cost of controls currently deployed
  2. The set of threats that could target an asset
  3. The likelihood that an audit finding is raised
  4. The probable frequency and probable magnitude of future loss Correct answer.

Explanation

Open FAIR defines risk as the probable frequency and probable magnitude of future loss, combining both dimensions rather than treating risk as a single likelihood score. This definition drives the factor-analysis structure of the ontology.

Question 2Open FAIR risk analysis concepts and terminology

Which pair of factors multiplies together to produce risk in the basic FAIR model?

  1. Risk appetite and tolerance
  2. Loss event frequency and loss magnitude Correct answer.
  3. Threat capability and asset value
  4. Vulnerability and control strength

Explanation

The core FAIR decomposition states that risk equals loss event frequency multiplied by loss magnitude. Each of those factors is then broken down further into sub-factors such as contact frequency, probability of action, and primary loss.

Question 3Open FAIR risk analysis concepts and terminology

A team states that a payment system experiences about four successful intrusions per year. Which FAIR factor are they quantifying?

  1. Secondary loss
  2. Risk appetite
  3. Vulnerability
  4. Loss event frequency Correct answer.

Explanation

Loss event frequency expresses how often a loss event is expected to occur in a given timeframe, here four times per year. It is the frequency half of the risk equation and is later refined into threat event frequency and vulnerability.

Question 4Open FAIR risk analysis concepts and terminology

Which term describes the probable frequency with which threat agents act against an asset?

  1. Primary loss
  2. Threat event frequency Correct answer.
  3. Risk tolerance
  4. Loss magnitude

Explanation

Threat event frequency captures how often threat agents are expected to act against the asset, regardless of whether those actions succeed. Vulnerability then converts threat events into loss events.

Question 5Open FAIR risk analysis concepts and terminology

An analyst reports that 20 percent of threat events against a server result in a loss event. Which FAIR factor does this percentage represent?

  1. Contact frequency
  2. Secondary loss probability
  3. Loss event frequency
  4. Vulnerability Correct answer.

Explanation

Vulnerability is the probability that a threat event becomes a loss event, commonly expressed as a percentage or ratio. It reflects the resistance strength of the asset relative to the threat capability.

Question 6Open FAIR risk analysis concepts and terminology

Which of the following is an example of a secondary loss in FAIR terms?

  1. Lost productivity of the organization's own staff
  2. Regulatory fine imposed after a breach Correct answer.
  3. Replacement cost of the organization's own hardware
  4. Revenue lost from the organization's own downtime

Explanation

Secondary losses are costs that fall on secondary stakeholders such as regulators, customers, or partners, and include fines, judgments, and response costs. Losses borne by the organization itself are primary losses.

Question 7Open FAIR risk analysis concepts and terminology

A risk analyst is decomposing loss magnitude and needs the factor that captures the organization's own costs to respond to and recover from an event. Which factor is it?

  1. Primary response loss Correct answer.
  2. Threat capability
  3. Vulnerability
  4. Secondary response loss

Explanation

Primary response loss covers the organization's own costs of investigating, containing, and recovering from an event. Secondary response loss instead covers costs incurred by other parties, such as notification and credit monitoring.

Question 8Open FAIR risk analysis concepts and terminology

In the FAIR ontology, which factor best explains why a low-skill attacker is unlikely to compromise a hardened system?

  1. The attacker's contact frequency is high
  2. The asset has high resistance strength Correct answer.
  3. The attacker's secondary loss probability is high
  4. The organization's risk appetite is low

Explanation

Resistance strength is the asset's ability to withstand a threat agent's actions, and it is compared against threat capability to derive vulnerability. A hardened asset has high resistance strength, so low-capability attackers are unlikely to succeed.

Question 9Open FAIR risk analysis concepts and terminology

Which statement correctly distinguishes threat capability from difficulty?

  1. Threat capability is the frequency of attacks; difficulty is the number of controls
  2. Threat capability is the cost of an event; difficulty is the probability of an event
  3. Threat capability is the resistance of the asset; difficulty is the skill of the agent
  4. Threat capability is the agent's skill and resources; difficulty is the resistance strength the agent must overcome Correct answer.

Explanation

Threat capability describes the resources and skill level of the threat agent, while difficulty represents the resistance strength of the asset to be overcome. Vulnerability arises from the comparison of the two.

Question 10Open FAIR risk analysis concepts and terminology

A CISO wants to express how much risk the organization is willing to pursue to achieve its objectives. Which FAIR decision concept applies?

  1. Loss event frequency
  2. Vulnerability
  3. Risk appetite Correct answer.
  4. Risk tolerance

Explanation

Risk appetite is the amount of risk an organization is willing to pursue or retain in pursuit of its objectives. Risk tolerance, by contrast, is the acceptable variation around that appetite.

Question 11Open FAIR risk analysis concepts and terminology

An organization has a risk appetite of 2 million dollars per year and accepts results up to 2.5 million dollars before escalating. Which concept describes the 500,000 dollar difference?

  1. Risk tolerance Correct answer.
  2. Loss magnitude
  3. Risk avoidance
  4. Secondary loss

Explanation

Risk tolerance is the acceptable variation around the stated risk appetite, so the band between 2 and 2.5 million dollars represents tolerance. Appetite is the target level, while tolerance is the permissible deviation from it.

Question 12Open FAIR risk analysis concepts and terminology

Which of the following is an example of a threat community rather than a single threat agent?

  1. A specific former employee
  2. A named contractor with database access
  3. A single automated scanner
  4. Organized criminal groups targeting financial institutions Correct answer.

Explanation

A threat community is a group of threat agents sharing common characteristics such as objectives, methods, and skill. Organized criminal groups form a community, while a single person or tool is an individual agent.

Question 13Open FAIR risk analysis concepts and terminology

A risk register lists a ransomware attack on the customer database. In FAIR terms, what is the asset in this scenario?

  1. The ransomware strain
  2. The annualized loss figure
  3. The customer database Correct answer.
  4. The criminal group

Explanation

The asset is the thing of value that the organization seeks to protect and that the threat agent acts against. In this scenario, the customer database is the asset, while the ransomware and group are threat elements.

Question 14Open FAIR risk analysis concepts and terminology

Which factor pair sits directly beneath loss event frequency in the FAIR taxonomy?

  1. Contact frequency and probability of action
  2. Primary loss and secondary loss
  3. Threat event frequency and vulnerability Correct answer.
  4. Threat capability and resistance strength

Explanation

Loss event frequency decomposes into threat event frequency and vulnerability, which are multiplied to yield the event rate. Threat event frequency is further decomposed into contact frequency and probability of action.

Question 15Open FAIR risk analysis concepts and terminology

An analyst determines that threat agents contact the asset 1,000 times per year and act maliciously in 10 percent of those contacts. What is the resulting threat event frequency?

  1. 1,000 events per year
  2. 10 events per year
  3. 100 events per year Correct answer.
  4. 10,000 events per year

Explanation

Threat event frequency equals contact frequency multiplied by probability of action. Multiplying 1,000 contacts by 0.10 yields 100 threat events per year.

Question 16Open FAIR risk analysis concepts and terminology

A threat event frequency of 200 per year combines with a vulnerability of 0.05. What is the loss event frequency?

  1. 100 per year
  2. 10 per year Correct answer.
  3. 4,000 per year
  4. 0.05 per year

Explanation

Loss event frequency is threat event frequency multiplied by vulnerability. Multiplying 200 by 0.05 gives 10 loss events per year, which then feeds into loss magnitude.

Question 17Open FAIR risk analysis concepts and terminology

Which statement best describes how FAIR treats the relationship between frequency and magnitude when expressing risk?

  1. Risk is the product of expected loss event frequency and expected loss magnitude Correct answer.
  2. Risk is the sum of frequency and magnitude expressed in dollars
  3. Risk is frequency alone when magnitude is uncertain
  4. Risk is the maximum of frequency and magnitude across scenarios

Explanation

FAIR combines the two dimensions multiplicatively, so risk equals loss event frequency times loss magnitude, often reported as annualized loss exposure. This preserves the distinction between how often events occur and how much each costs.

Question 18Open FAIR risk analysis concepts and terminology

A company reports an annualized loss exposure of 3 million dollars for a given scenario. What does this figure represent in FAIR terms?

  1. The budget allocated to controls for the scenario
  2. The single worst-case loss the scenario could produce
  3. The probability that the scenario occurs at least once
  4. The expected loss from the scenario over one year, combining frequency and magnitude Correct answer.

Explanation

Annualized loss exposure expresses expected loss over a one-year period by combining loss event frequency and loss magnitude. It is an expected value, not a worst case, and it differs from a control budget or a bare probability.

Question 19Open FAIR risk analysis concepts and terminology

Which statement about the Open FAIR ontology's treatment of controls is most accurate?

  1. Controls directly reduce risk and are not represented as factors in the ontology
  2. Controls influence risk indirectly by affecting factors such as resistance strength and response capability Correct answer.
  3. Controls replace the need to estimate loss event frequency
  4. Controls are only relevant when calculating secondary loss probability

Explanation

In the FAIR ontology, controls do not appear as a direct risk factor; instead they change risk by altering underlying factors such as resistance strength, threat event frequency, or response capability. This keeps the analysis focused on measurable factors rather than control checklists.

Question 20Open FAIR risk analysis concepts and terminology

Two analysts disagree: one says a firewall reduces risk, the other says FAIR has no control factor. Which reconciliation is correct?

  1. The firewall must be entered as a threat agent in the model
  2. The firewall is not analyzable in FAIR because it is a control
  3. The firewall changes risk by altering factors such as resistance strength or contact frequency Correct answer.
  4. The firewall affects only the risk appetite threshold

Explanation

FAIR models controls through their effect on analytic factors, so a firewall can reduce contact frequency or raise resistance strength. The ontology has no standalone control factor, which is why both analysts can be right.

Question 21Open FAIR risk analysis concepts and terminology

Which factor most directly captures the likelihood that a threat agent will choose to act against a specific asset?

  1. Secondary loss magnitude
  2. Risk tolerance
  3. Resistance strength
  4. Probability of action Correct answer.

Explanation

Probability of action is the likelihood that a threat agent, having encountered the asset, decides to act against it. It combines with contact frequency to produce threat event frequency.

Question 22Open FAIR risk analysis concepts and terminology

An analyst is estimating loss magnitude and wants to include costs such as customer notification, credit monitoring, and legal judgments. Which category do these belong to?

  1. Threat event frequency
  2. Primary response loss
  3. Secondary response loss Correct answer.
  4. Contact frequency

Explanation

Secondary response loss covers costs incurred by secondary stakeholders in responding to an event, such as notification, credit monitoring, and legal defense. These differ from the organization's own primary response costs.

Question 23Open FAIR risk analysis concepts and terminology

Which statement best explains why FAIR separates primary and secondary loss?

  1. Because secondary loss cannot be estimated quantitatively
  2. Because primary loss is always larger than secondary loss
  3. Because the two are borne by different stakeholders and respond to different controls Correct answer.
  4. Because primary loss applies only to data assets

Explanation

Primary losses fall on the organization itself, while secondary losses fall on other stakeholders such as regulators and customers. Separating them lets analysts apply different controls and credibility weighting to each component.

Question 24Open FAIR risk analysis concepts and terminology

In FAIR, which factor describes the frequency with which a threat agent encounters or has access to the asset?

  1. Probability of action
  2. Contact frequency Correct answer.
  3. Vulnerability
  4. Loss magnitude

Explanation

Contact frequency is how often a threat agent comes into contact with, or has access to, the asset. It is multiplied by probability of action to yield threat event frequency.

Question 25Open FAIR risk analysis concepts and terminology

Which statement about risk analysis results in FAIR is most defensible?

  1. Results are point estimates and should never be expressed as ranges
  2. Results are expressed as distributions reflecting uncertainty in the input factors Correct answer.
  3. Results are qualitative ratings on a five-point scale
  4. Results must be expressed only as a single monetary value

Explanation

FAIR analysis propagates uncertainty through the factor model, so outputs are distributions rather than single values. This allows decision makers to see ranges and confidence rather than a false point estimate.

Question 26Open FAIR risk analysis concepts and terminology

In the Open FAIR ontology, which top-level pair of factors together defines risk?

  1. Risk appetite and risk tolerance
  2. Loss event frequency and loss magnitude Correct answer.
  3. Threat capability and control strength
  4. Asset value and vulnerability

Explanation

Open FAIR defines risk as the probable frequency and probable magnitude of future loss, so risk decomposes into loss event frequency and loss magnitude. Every other factor in the ontology sits beneath one of these two branches.

Question 27Open FAIR risk analysis concepts and terminology

An analyst states that a risk scenario involves a threat agent, an asset, and a loss event. Which element of the FAIR ontology does the loss event represent?

  1. The inventory record that documents where the asset is stored
  2. The moment when a threat agent acts against the asset with a resulting impact Correct answer.
  3. The annual budget allocated to information security controls
  4. The set of regulatory requirements that apply to the asset

Explanation

A loss event in FAIR is an incident in which a threat agent acts against an asset and produces loss. Its frequency is modeled as loss event frequency, which combines threat event frequency and vulnerability.

Question 28Open FAIR risk analysis concepts and terminology

Which term in Open FAIR describes the probable frequency with which a threat agent acts against an asset in a way that produces loss?

  1. Susceptibility
  2. Threat event frequency
  3. Loss event frequency Correct answer.
  4. Resistance strength

Explanation

Loss event frequency is the probable frequency of loss-producing actions against the asset. It is derived from threat event frequency combined with vulnerability, which distinguishes it from raw contact frequency.

Question 29Open FAIR risk analysis concepts and terminology

In the FAIR taxonomy, what does vulnerability represent?

  1. The probability that a threat event becomes a loss event Correct answer.
  2. The total count of controls deployed on an asset
  3. The annual cost of maintaining security operations
  4. The number of unpatched software defects in the environment

Explanation

Vulnerability in FAIR is the probability that a threat event results in a loss event. It is modeled through resistance strength and susceptibility rather than through a simple defect count.

Question 30Open FAIR risk analysis concepts and terminology

A risk analyst needs the FAIR factor that captures the value of the asset itself, independent of how often it is attacked. Which factor applies?

  1. Loss event frequency
  2. Threat event frequency
  3. Primary loss Correct answer.
  4. Secondary loss

Explanation

Primary loss is the loss that falls directly on the organization that owns or controls the asset, which includes the asset's own value and response costs. Frequency factors describe how often events occur rather than what the asset is worth.

Question 31Open FAIR risk analysis concepts and terminology

Which pair of factors sits directly beneath loss magnitude in the Open FAIR taxonomy?

  1. Primary loss and secondary loss Correct answer.
  2. Threat event frequency and vulnerability
  3. Threat capability and threat intent
  4. Resistance strength and susceptibility

Explanation

Loss magnitude decomposes into primary loss, borne by the asset owner, and secondary loss, borne by other parties. The other listed pairs belong to the frequency branch of the ontology.

Question 32Open FAIR risk analysis concepts and terminology

Which FAIR factor describes the probable frequency with which a threat agent initiates action against an asset?

  1. Vulnerability
  2. Primary loss
  3. Loss event frequency
  4. Threat event frequency Correct answer.

Explanation

Threat event frequency is the probable frequency of actions by a threat agent directed at the asset. It becomes loss event frequency only after vulnerability is applied.

Question 33Open FAIR risk analysis concepts and terminology

In Open FAIR terminology, what is a risk scenario?

  1. A regulatory filing that reports breaches to authorities
  2. A list of every control currently protecting the organization
  3. A combination of a threat agent, an asset, and a loss event that can be analyzed as a unit Correct answer.
  4. A schedule for testing disaster recovery plans

Explanation

A risk scenario pairs a threat agent with an asset and a loss event, providing the unit of analysis for FAIR assessments. Scenarios are analyzed one at a time to produce frequency and magnitude estimates.

Question 34Open FAIR risk analysis concepts and terminology

An analyst estimates that a threat community sends 500 attack attempts per year at a web service, and 20 of those attempts succeed. Using FAIR factors, which value represents loss event frequency?

  1. 480 per year
  2. 20 per year Correct answer.
  3. 500 per year
  4. 0.04 per year

Explanation

Loss event frequency counts only the events that produce loss, which here is the 20 successful attempts per year. The 500 attempts are threat event frequency, and their ratio gives vulnerability.

Question 35Open FAIR risk analysis concepts and terminology

A threat event frequency of 400 per year combines with a vulnerability of 0.10. What is the resulting loss event frequency?

  1. 0.10 per year
  2. 40 per year Correct answer.
  3. 400 per year
  4. 4 per year

Explanation

Loss event frequency equals threat event frequency multiplied by vulnerability, so 400 times 0.10 yields 40 events per year. This multiplication is the standard relationship in the frequency branch.

Question 36Open FAIR risk analysis concepts and terminology

An analyst is decomposing threat event frequency and needs the factor that describes whether a threat agent has the resources and skill to act. Which factor applies?

  1. Susceptibility
  2. Threat capability Correct answer.
  3. Resistance strength
  4. Threat intent

Explanation

Threat capability captures the skill and resources a threat agent can bring to bear against the asset. It is paired with threat intent, which captures whether the agent is motivated to act.

Question 37Open FAIR risk analysis concepts and terminology

In a FAIR analysis, an attacker group is highly motivated to breach a specific database but lacks the tools to do so. Which factor combination best describes this situation?

  1. High resistance strength with low susceptibility
  2. High threat capability with high vulnerability
  3. Low threat intent with high threat capability
  4. High threat intent with low threat capability Correct answer.

Explanation

Threat intent reflects the agent's motivation to act, while threat capability reflects the skill and resources available. A motivated but poorly equipped group therefore shows high intent and low capability.

Question 38Open FAIR risk analysis concepts and terminology

Which statement correctly describes how resistance strength affects loss event frequency in Open FAIR?

  1. Higher resistance strength increases threat event frequency by attracting more attackers
  2. Higher resistance strength reduces the probability that a threat event becomes a loss event Correct answer.
  3. Resistance strength is identical to susceptibility and is measured on the same scale
  4. Resistance strength has no effect on loss event frequency because it is a magnitude factor

Explanation

Resistance strength is one of the two components of vulnerability, and higher resistance lowers the chance that a threat event succeeds. Because vulnerability multiplies threat event frequency, lower vulnerability reduces loss event frequency.

Question 39Open FAIR risk analysis concepts and terminology

A threat agent has frequent access to an asset but rarely acts maliciously. Which FAIR factor most directly captures the rarity of malicious action?

  1. Primary loss
  2. Threat intent Correct answer.
  3. Threat capability
  4. Resistance strength

Explanation

Threat intent captures the probability that a threat agent chooses to act against the asset. Frequent access is threat event frequency, and the decision to act is governed by intent.

Question 40Open FAIR risk analysis concepts and terminology

An analyst wants to model the costs of responding to an incident internally, such as investigation and remediation labor. Which FAIR loss factor should be used?

  1. Secondary response loss
  2. Vulnerability
  3. Threat event frequency
  4. Primary response loss Correct answer.

Explanation

Primary response loss covers the asset owner's own costs to investigate and remediate an incident. Secondary response loss covers costs incurred by other parties, such as customers or partners.

Question 41Open FAIR risk analysis concepts and terminology

Which factor pair decomposes secondary loss in the Open FAIR taxonomy?

  1. Threat event frequency and vulnerability
  2. Secondary loss event frequency and secondary loss magnitude Correct answer.
  3. Primary loss event frequency and primary loss magnitude
  4. Loss event frequency and loss magnitude

Explanation

Secondary loss is decomposed into the frequency of secondary loss events and their magnitude, mirroring the structure of primary loss. This allows analysts to model stakeholder-driven losses such as fines and litigation separately.

Question 42Open FAIR risk analysis concepts and terminology

A regulator fines a company after a breach, and the fine is paid from corporate funds. How does Open FAIR classify this cost?

  1. Threat event frequency
  2. Secondary loss borne by the organization Correct answer.
  3. Primary loss avoided by the organization
  4. Resistance strength

Explanation

Secondary loss arises from the reactions of stakeholders such as regulators, customers, and shareholders, even when the organization ultimately pays. Fines and judgments are the classic example of secondary loss.

Question 43Open FAIR risk analysis concepts and terminology

Which statement best explains why Open FAIR decomposes loss magnitude into six forms of loss?

  1. Different loss forms have distinct drivers and can be estimated and mitigated separately Correct answer.
  2. All loss forms are governed by a single driver and are estimated together
  3. The decomposition removes the need to estimate frequency
  4. The ontology requires exactly six controls for each asset

Explanation

The six loss forms, covering productivity, response, replacement, fines and judgments, competitive advantage, and reputation, have different drivers and responses. Decomposing them lets analysts estimate each separately and target controls where they matter.

Question 44Open FAIR risk analysis concepts and terminology

A risk assessment produces a range of annualized loss exposure rather than a single number. Which statement best explains the FAIR rationale for this?

  1. A single number is always preferred but is unavailable in the current tooling
  2. Inputs are uncertain, so results are expressed as distributions that convey likelihood across a range of outcomes Correct answer.
  3. Ranges are used only when the analyst lacks a risk appetite statement
  4. Distributions are required by regulators for every risk assessment

Explanation

FAIR treats inputs as uncertain and represents them as distributions, so outputs are distributions of loss exposure. This conveys the likelihood of different loss levels rather than a false sense of precision.

Question 45Open FAIR risk analysis concepts and terminology

An analyst reports a loss event frequency of 2 per year and a loss magnitude with a most likely value of 500,000 dollars. Which statement about the annualized loss exposure is most defensible?

  1. It is a distribution whose expected value is roughly 1 million dollars per year Correct answer.
  2. It cannot be computed without knowing the asset's purchase price
  3. It is exactly 1 million dollars per year with no uncertainty
  4. It equals the loss magnitude because frequency is below one

Explanation

Annualized loss exposure combines frequency and magnitude, and with uncertain inputs it is a distribution rather than a fixed number. Its expected value here is approximately 2 times 500,000 dollars, or 1 million dollars per year.

Question 46Open FAIR risk analysis concepts and terminology

Which statement best describes how Open FAIR treats the effect of controls on risk?

  1. Controls are excluded from the ontology because they are not measurable
  2. Controls act by changing one or more risk factors, such as resistance strength or response capability Correct answer.
  3. Controls are a separate top-level factor that directly sets the risk value
  4. Controls affect only secondary loss and never influence frequency

Explanation

FAIR has no standalone control factor; controls influence risk by modifying underlying factors such as resistance strength, threat event frequency, or response capability. This lets analysts show the mechanism by which a control changes results.

Question 47Open FAIR risk analysis concepts and terminology

One analyst claims a new endpoint detection tool reduces risk, while another says FAIR has no control factor so the claim cannot be modeled. Which reconciliation is most consistent with Open FAIR?

  1. Model the tool as reducing threat intent, since attackers become less motivated
  2. Model the tool as increasing resistance strength, which lowers vulnerability and therefore loss event frequency Correct answer.
  3. Model the tool as reducing loss magnitude only, since controls never affect frequency
  4. Model the tool as a new top-level risk factor that replaces vulnerability

Explanation

Controls are represented through the factors they change, and endpoint detection primarily raises resistance strength. Higher resistance lowers vulnerability, which reduces loss event frequency when multiplied by threat event frequency.

Question 48Open FAIR risk analysis concepts and terminology

A risk analyst must choose between reporting a mean annualized loss exposure and a loss exceedance curve. Which statement best reflects Open FAIR guidance?

  1. The two are interchangeable because both reduce to a single expected value
  2. The mean is preferred because a curve cannot be compared with risk appetite
  3. A loss exceedance curve communicates the probability of exceeding various loss levels, while a mean alone hides that shape Correct answer.
  4. A loss exceedance curve is only valid when loss event frequency is below one

Explanation

A loss exceedance curve shows the probability of losses above each threshold, preserving the shape of the distribution. A mean alone compresses the distribution and can obscure tail outcomes relevant to decision makers.

Question 49Open FAIR risk analysis concepts and terminology

An organization wants to compare two scenarios with different frequency and magnitude profiles. Which approach is most consistent with Open FAIR?

  1. Compare their loss exceedance curves at the organization's tolerance threshold Correct answer.
  2. Compare their control inventories to see which is larger
  3. Compare only their most likely loss magnitudes
  4. Compare only their threat event frequencies

Explanation

Comparing exceedance curves at a chosen threshold shows which scenario is more likely to breach tolerance. This respects both frequency and magnitude rather than collapsing the analysis to a single factor.

Question 50Open FAIR risk analysis concepts and terminology

A team argues that a scenario with a loss event frequency below one per year can be ignored because it is unlikely. Which response is most consistent with Open FAIR?

  1. Frequency below one means the scenario has no loss magnitude
  2. Low-frequency scenarios can still carry large magnitude and should be evaluated with the full distribution Correct answer.
  3. The scenario should be reclassified as a secondary loss to remove it from analysis
  4. Such scenarios should be excluded because FAIR only models frequent events

Explanation

FAIR models risk as frequency and magnitude together, so a rare event can still produce significant loss exposure. The distribution captures the probability of large outcomes even when events are infrequent.