I85PREP
⌘ K
Open FAIR Foundation study materials
Open FAIR Foundation study resources

Open FAIR Foundation practice questions

One question at a time. Build your Open FAIR Foundation understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Risk Analysis (Open FAIR)

In Open FAIR, which two factors are multiplied together to express the risk associated with a single loss event?

  1. Asset value and vulnerability score
  2. Event frequency and loss magnitude Correct answer.
  3. Control cost and residual exposure
  4. Threat capability and control strength

Explanation

Open FAIR defines risk as the probable frequency and probable magnitude of future loss. For a single scenario, the frequency of the event is combined with the loss magnitude per occurrence to produce an annualized loss estimate. Neither factor alone constitutes risk in the taxonomy.

Question 2Risk Analysis (Open FAIR)

Which statement best describes how Open FAIR treats uncertainty in risk analysis?

  1. It reports a single deterministic point estimate for each scenario
  2. It replaces probability with a qualitative high-medium-low rating
  3. It excludes uncertainty and analyzes only known historical losses
  4. It expresses risk as a range of probable outcomes with associated likelihoods Correct answer.

Explanation

Open FAIR is a quantitative approach that represents risk as a distribution of probable outcomes rather than one number. Uncertainty is expressed through ranges and confidence levels, which supports informed decision-making. Qualitative scales are not the core method.

Question 3Risk Analysis (Open FAIR)

A risk analyst is decomposing the loss magnitude for a data breach scenario. Which pair of factors does Open FAIR use to describe loss magnitude?

  1. Threat event frequency and vulnerability
  2. Primary loss and secondary loss Correct answer.
  3. Contact frequency and probability of action
  4. Asset value and control gap

Explanation

Loss magnitude is split into primary loss, borne directly by the affected asset owner, and secondary loss, which arises from reactions of other parties such as regulators, customers, or shareholders. These components are estimated separately and then combined.

Question 4Risk Analysis (Open FAIR)

In the Open FAIR taxonomy, threat event frequency is best described as which of the following?

  1. The number of times a threat agent acts against an asset in a given period Correct answer.
  2. The proportion of assets that are exposed to a threat community
  3. The likelihood that a threat agent has the capability to succeed
  4. The cost incurred each time a loss event occurs

Explanation

Threat event frequency estimates how often a threat agent acts against an asset within a defined time frame, typically a year. It is a rate, not a probability of success or a cost figure. It sits on the frequency side of the risk equation.

Question 5Risk Analysis (Open FAIR)

An analyst estimates that a threat agent contacts an asset 500 times per year and that, on average, the agent acts against the asset in 10 percent of those contacts. What is the estimated threat event frequency?

  1. 500 events per year
  2. 5 events per year
  3. 50 events per year Correct answer.
  4. 5000 events per year

Explanation

Threat event frequency equals contact frequency multiplied by the probability of action. Here 500 contacts times 0.10 gives 50 threat events per year. The contact rate alone overstates the action rate.

Question 6Risk Analysis (Open FAIR)

Which factor measures the likelihood that a threat event becomes a loss event given the resistance strength of the asset?

  1. Vulnerability Correct answer.
  2. Resistance strength
  3. Susceptibility
  4. Loss event frequency

Explanation

Vulnerability is the probability that a threat event results in a loss event, reflecting how well controls resist the threat. It is combined with threat event frequency to derive loss event frequency. Resistance strength is the control-side input that shapes vulnerability.

Question 7Risk Analysis (Open FAIR)

A threat event frequency of 40 per year combines with a vulnerability of 0.25. What is the resulting loss event frequency?

  1. 16 per year
  2. 10 per year Correct answer.
  3. 160 per year
  4. 25 per year

Explanation

Loss event frequency is threat event frequency multiplied by vulnerability. Multiplying 40 by 0.25 yields 10 loss events per year. This is the rate at which loss events actually occur after controls are considered.

Question 8Risk Analysis (Open FAIR)

In Open FAIR, controls are primarily analyzed by their effect on which two elements?

  1. Threat community and contact frequency
  2. Secondary loss and reputation
  3. Resistance strength and vulnerability Correct answer.
  4. Asset value and primary loss

Explanation

Controls reduce risk by increasing resistance strength, which in turn lowers vulnerability, and by affecting the frequency or magnitude of loss events. The framework links control investment to these measurable factors. Other listed items are not the primary control levers.

Question 9Risk Analysis (Open FAIR)

Which pair of factors combines to determine the susceptibility of an asset to a threat?

  1. Asset value and control cost
  2. Contact frequency and loss magnitude
  3. Resistance strength and threat capability Correct answer.
  4. Primary loss and secondary loss

Explanation

Susceptibility reflects the match between the threat's capability and the resistance strength of the asset's controls. When threat capability exceeds resistance strength, susceptibility rises. The other pairs belong to different parts of the taxonomy.

Question 10Risk Analysis (Open FAIR)

An organization wants to compare the annualized loss exposure of two scenarios. Which Open FAIR output is designed for this comparison?

  1. Control maturity level
  2. Asset criticality score
  3. Threat event frequency alone
  4. Risk, expressed as a distribution of annualized loss Correct answer.

Explanation

Open FAIR expresses risk as a distribution of annualized loss, allowing scenarios to be compared on a common quantitative basis. Frequency alone omits magnitude, and maturity or criticality scores are not the framework's risk output.

Question 11Risk Analysis (Open FAIR)

Which statement correctly distinguishes primary loss from secondary loss in Open FAIR?

  1. Primary loss is the direct response cost to the organization, while secondary loss is the response of other parties such as regulators or customers Correct answer.
  2. Primary loss excludes any response costs and covers only fines
  3. Primary loss is always larger than secondary loss for every scenario
  4. Secondary loss is incurred only when controls fail completely

Explanation

Primary loss captures the direct costs the organization bears in responding to an event, such as investigation and remediation. Secondary loss captures reactions from external stakeholders, including regulatory fines and reputation damage. The relative size depends on the scenario.

Question 12Risk Analysis (Open FAIR)

In threat community analysis, what does the term 'contact frequency' represent?

  1. How often the asset is backed up
  2. How often controls are tested
  3. How often loss events are reported
  4. How often a threat agent interacts with the asset or environment Correct answer.

Explanation

Contact frequency measures how often a threat agent comes into contact with the asset or its environment. It is one input to threat event frequency, along with probability of action. It is a threat-side measure, not an operational or reporting metric.

Question 13Risk Analysis (Open FAIR)

Which of the following best describes probability of action in the Open FAIR taxonomy?

  1. The likelihood that a threat agent will act against the asset given contact Correct answer.
  2. The likelihood that a loss event is detected
  3. The likelihood that a threat community exists
  4. The likelihood that a control will fail during an event

Explanation

Probability of action is the chance that a threat agent, having made contact, chooses to act against the asset. It converts contact frequency into threat event frequency. It does not describe control failure, detection, or the existence of a threat community.

Question 14Risk Analysis (Open FAIR)

A risk analyst is estimating secondary loss for a customer data breach. Which factor most directly drives the magnitude of secondary loss?

  1. The strength of the firewall rules
  2. The cost of the antivirus license
  3. The number of records affected and the reactions of affected parties Correct answer.
  4. The frequency of threat contacts

Explanation

Secondary loss depends on how external parties react, such as regulators, customers, and shareholders, and on the scale of exposure like records affected. Technical control details and license costs do not directly set secondary loss magnitude.

Question 15Risk Analysis (Open FAIR)

Which statement best captures the relationship between risk and controls in Open FAIR analysis?

  1. Controls reduce risk by lowering loss event frequency or loss magnitude, and the analysis compares that reduction to control cost Correct answer.
  2. Controls affect only the threat community size
  3. Controls have no measurable effect on loss magnitude
  4. Controls eliminate risk entirely once implemented

Explanation

Open FAIR treats controls as levers that lower either the frequency of loss events or their magnitude. A proper analysis weighs the risk reduction against the cost of the control. No control eliminates risk entirely.

Question 16Risk Analysis (Open FAIR)

In Open FAIR, what is the purpose of defining a risk scenario?

  1. To pair a specific threat with a specific asset and loss event for analysis Correct answer.
  2. To list all assets in the organization
  3. To document the control inventory
  4. To record historical incident tickets

Explanation

A risk scenario pairs a threat community, an asset, and a loss event so that frequency and magnitude can be estimated coherently. Scenarios make analysis specific and comparable. Asset lists and ticket records serve different purposes.

Question 17Risk Analysis (Open FAIR)

An analyst finds that threat capability is well above resistance strength for a given asset. What does Open FAIR suggest about susceptibility?

  1. Susceptibility is high, so a larger share of threat events become loss events Correct answer.
  2. Susceptibility equals the contact frequency
  3. Susceptibility is low, so few threat events become loss events
  4. Susceptibility is unaffected by capability and resistance

Explanation

When threat capability exceeds resistance strength, the asset is more susceptible, raising the probability that a threat event becomes a loss event. This increases vulnerability and therefore loss event frequency. Susceptibility is not independent of these factors.

Question 18Risk Analysis (Open FAIR)

Which output best supports a decision about whether to fund a proposed security control?

  1. The number of assets in the inventory
  2. The reduction in annualized loss exposure compared with the control's cost Correct answer.
  3. The total number of threat agents in the community
  4. The count of past incidents only

Explanation

A defensible funding decision compares the expected reduction in annualized loss exposure with the cost of the control. This is a cost-benefit comparison grounded in the risk estimate. Counts of threat agents, past incidents, or assets do not by themselves justify spend.

Question 19Risk Analysis (Open FAIR)

In Open FAIR, which term describes the strength of a control in resisting a threat event?

  1. Susceptibility
  2. Loss event frequency
  3. Vulnerability
  4. Resistance strength Correct answer.

Explanation

Resistance strength is the control-side measure of how well an asset resists a threat event. Higher resistance strength lowers vulnerability and thus loss event frequency. Vulnerability and susceptibility are derived probabilities, not the strength itself.

Question 20Risk Analysis (Open FAIR)

A threat community is best described in Open FAIR as which of the following?

  1. The inventory of assets at a site
  2. A group of actors with similar capabilities and intents that pose a threat to an asset Correct answer.
  3. The set of all controls protecting an asset
  4. The collection of loss events in a year

Explanation

A threat community groups actors sharing similar capabilities, intents, and methods, allowing their behavior to be modeled together. It is a threat-side concept, distinct from controls, loss events, or asset inventories. This grouping keeps frequency estimates tractable.

Question 21Risk Analysis (Open FAIR)

An analyst is uncertain about the vulnerability estimate and wants to reflect that uncertainty. Which Open FAIR practice is most appropriate?

  1. Use the single highest possible value to be conservative
  2. Ignore vulnerability and analyze only threat event frequency
  3. Replace vulnerability with a qualitative rating
  4. Use a range or distribution for vulnerability and propagate it through the calculation Correct answer.

Explanation

Open FAIR encourages expressing uncertain inputs as ranges or distributions so that uncertainty propagates into the risk output. This yields a range of probable loss rather than a misleading single number. Choosing an extreme value or dropping the factor distorts the analysis.

Question 22Risk Analysis (Open FAIR)

Which statement correctly describes how loss event frequency is derived in Open FAIR?

  1. It is contact frequency multiplied by loss magnitude
  2. It is threat event frequency multiplied by vulnerability Correct answer.
  3. It is asset value divided by control cost
  4. It is secondary loss plus primary loss

Explanation

Loss event frequency results from multiplying threat event frequency by vulnerability. This captures how often threats act and how often those actions succeed in causing loss. The other formulas mix concepts from different parts of the taxonomy.

Question 23Risk Analysis (Open FAIR)

Why does Open FAIR separate primary loss from secondary loss in the analysis?

  1. Because the two are driven by different parties and require different estimation inputs Correct answer.
  2. Because secondary loss is always zero in practice
  3. Because they use different currencies
  4. Because primary loss cannot be quantified

Explanation

Primary loss reflects the organization's own response costs, while secondary loss reflects reactions of external stakeholders. Separating them allows each to be estimated with appropriate inputs and assumptions. Neither is inherently zero or unquantifiable.

Question 24Risk Analysis (Open FAIR)

Which of the following is the best example of a well-formed Open FAIR risk scenario statement?

  1. The organization has many risks
  2. Security should be improved
  3. A phishing threat community causes credential theft against the finance email system, leading to fraudulent payments Correct answer.
  4. The firewall is configured correctly

Explanation

A well-formed scenario names a threat community, an asset, and a loss event, making frequency and magnitude estimable. Vague statements or control descriptions cannot be analyzed quantitatively. Specificity is what enables the Open FAIR calculation.

Question 25Risk Analysis (Open FAIR)

An organization estimates loss event frequency of 4 per year and an average loss magnitude of 250,000 per event. What is the expected annualized loss?

  1. 250,004
  2. 4,000,000
  3. 1,000,000 Correct answer.
  4. 62,500

Explanation

Expected annualized loss equals loss event frequency multiplied by average loss magnitude. Four events times 250,000 gives 1,000,000 per year. This is the central tendency of the annualized loss distribution.

Question 26Risk Analysis (Open FAIR)

In the Open FAIR ontology, which four factors together make up the Risk factor?

  1. Threat Event Frequency, Vulnerability, Primary Loss, Secondary Loss Correct answer.
  2. Asset Value, Control Strength, Threat Event Frequency, Productivity Loss
  3. Contact Frequency, Probability of Action, Resistance Strength, Loss Magnitude
  4. Threat Capability, Resistance Strength, Loss Event Frequency, Loss Magnitude

Explanation

Risk in Open FAIR decomposes into Loss Event Frequency and Loss Magnitude, and each of those in turn decomposes further, so the complete set of leaf factors is Threat Event Frequency, Vulnerability, Primary Loss, and Secondary Loss. These four are the factors an analyst ultimately estimates to produce a risk result.

Question 27Risk Analysis (Open FAIR)

An analyst records a loss magnitude estimate as a range from 2 million to 8 million with 90% confidence. Which Open FAIR practice does this illustrate?

  1. Calibrated estimation using confidence intervals Correct answer.
  2. Point estimation of loss magnitude
  3. Deterministic scenario weighting
  4. Control gap assessment

Explanation

Open FAIR expects factor estimates to be expressed as calibrated ranges with an associated confidence level rather than single values. Capturing a 90% confidence interval around loss magnitude preserves the analyst's uncertainty so it can propagate into the risk result.

Question 28Risk Analysis (Open FAIR)

What does the Open FAIR term 'loss magnitude' represent for a single loss event?

  1. The financial impact to the organization from that event, including primary and secondary components Correct answer.
  2. The cost of the controls deployed to prevent the event
  3. The total revenue of the business unit affected by the event
  4. The frequency with which the asset is contacted by the threat community

Explanation

Loss magnitude is the impact side of the risk equation and captures the financial consequence to the organization of a single loss event. It is composed of primary loss, borne directly by the asset owner, and secondary loss, borne by other parties such as regulators or customers.

Question 29Risk Analysis (Open FAIR)

Which pair of Open FAIR factors directly produces Loss Event Frequency?

  1. Threat Event Frequency and Vulnerability Correct answer.
  2. Contact Frequency and Loss Magnitude
  3. Threat Capability and Resistance Strength
  4. Primary Loss and Secondary Loss

Explanation

Loss Event Frequency is defined as the frequency with which a threat event results in loss, and it is derived by combining Threat Event Frequency with Vulnerability. Threat events that do not encounter sufficient vulnerability simply do not become loss events.

Question 30Risk Analysis (Open FAIR)

Which statement best describes how Open FAIR treats the relationship between asset value and loss magnitude?

  1. Asset value and loss magnitude are treated as identical concepts
  2. Loss magnitude is calculated as asset value multiplied by threat event frequency
  3. Loss magnitude is estimated independently for each loss event and is not simply a percentage of asset value Correct answer.
  4. Asset value is irrelevant because Open FAIR analyzes only likelihood

Explanation

Open FAIR does not derive loss magnitude mechanically from asset value; the analyst estimates the financial impact of a loss event directly, considering what actually happens to the organization. Asset value may inform that judgment but is not a multiplier in the model.

Question 31Risk Analysis (Open FAIR)

In Open FAIR, what does the term 'risk' specifically refer to?

  1. The probability that a control will fail during an audit
  2. The list of vulnerabilities identified by a scanning tool
  3. The effect of uncertainty on objectives, expressed as the probable frequency and probable magnitude of future loss Correct answer.
  4. The difference between the current and desired security maturity level

Explanation

Open FAIR defines risk as the probable frequency and probable magnitude of future loss, which is why every analysis produces a frequency distribution and a loss distribution. This definition keeps risk quantitative and comparable across scenarios.

Question 32Risk Analysis (Open FAIR)

Which element of the Open FAIR taxonomy describes how likely a threat community is to act against an asset at all?

  1. Secondary loss
  2. Vulnerability
  3. Probability of action Correct answer.
  4. Resistance strength

Explanation

Probability of action captures the likelihood that a threat community, once in contact with the asset, chooses to act against it. It combines with contact frequency to produce Threat Event Frequency in the ontology.

Question 33Risk Analysis (Open FAIR)

An analyst wants to express the output of an Open FAIR analysis for a scenario as a single summary figure suitable for a risk register. Which statistic is most appropriate?

  1. The maximum possible single loss event
  2. The threat capability rating of the most capable threat community
  3. The mean annualized loss exposure from the loss distribution Correct answer.
  4. The number of controls currently deployed

Explanation

Annualized loss exposure summarizes the loss distribution as an expected annual loss and is the standard summary figure for comparing scenarios and populating a risk register. It preserves the frequency and magnitude information in one number.

Question 34Risk Analysis (Open FAIR)

An analyst estimates Threat Event Frequency at 20 per year and Vulnerability at 0.10. What is the resulting Loss Event Frequency?

  1. 0.005 per year
  2. 2 per year Correct answer.
  3. 200 per year
  4. 20.1 per year

Explanation

Loss Event Frequency is the product of Threat Event Frequency and Vulnerability, so 20 multiplied by 0.10 gives 2 loss events per year. The remaining threat events are absorbed by the asset's resistance.

Question 35Risk Analysis (Open FAIR)

A risk team produces a loss exceedance curve for a scenario. How should the curve be read?

  1. It shows the control cost required at each security maturity level
  2. It shows the number of threat events expected at each threat capability level
  3. It shows the asset value at each point during the incident lifecycle
  4. It shows, for each loss amount, the probability that annual loss will exceed that amount Correct answer.

Explanation

A loss exceedance curve plots loss amount against the probability of exceeding that amount in a given period, giving decision makers a view of tail risk rather than a single expected value. It is a standard Open FAIR output alongside annualized loss exposure.

Question 36Risk Analysis (Open FAIR)

Two scenarios have the same annualized loss exposure of 500,000, but scenario A has a much fatter tail. What does Open FAIR analysis suggest the analyst should do?

  1. Discard scenario A because tail events cannot be estimated
  2. Present the loss exceedance curves alongside the expected loss so decision makers see the differing tail exposure Correct answer.
  3. Report only the maximum single loss for both scenarios
  4. Treat the scenarios as identical because the expected annual loss matches

Explanation

Equal expected annual loss does not mean equal risk when the distributions differ in shape, so Open FAIR outputs include exceedance curves to communicate tail risk. Decision makers can then weigh the probability of severe outcomes, not just the average.

Question 37Risk Analysis (Open FAIR)

An analyst is estimating Vulnerability for an asset facing an insider threat. Which reasoning best follows Open FAIR?

  1. Estimate the asset value and divide by the number of insiders
  2. Estimate how often insiders are hired into the organization
  3. Compare the threat community's capability against the resistance strength of the controls protecting the asset Correct answer.
  4. Assume vulnerability equals one whenever the threat is internal

Explanation

Vulnerability reflects whether a threat event succeeds, which depends on the threat community's capability relative to the resistance strength protecting the asset. When capability exceeds resistance, vulnerability rises toward one; when resistance dominates, it falls toward zero.

Question 38Risk Analysis (Open FAIR)

A team wants to show how a proposed control would change risk before committing budget. Which Open FAIR approach supports this?

  1. Add the control cost to the current annualized loss exposure and report the sum
  2. Report the control's maturity rating as the new risk value
  3. Remove the loss magnitude factor from the model once the control is deployed
  4. Rerun the analysis with the factor estimates the control is expected to change and compare the resulting loss exposure to the current analysis Correct answer.

Explanation

Open FAIR supports control evaluation by re-estimating the factors a control affects, such as resistance strength or loss magnitude, and comparing the resulting risk to the baseline. The difference in loss exposure can then be weighed against the control's cost.

Question 39Risk Analysis (Open FAIR)

Which situation best demonstrates a well-scoped Open FAIR risk scenario?

  1. The security team needs more funding this year
  2. A hacker group uses stolen credentials to access the customer database and exfiltrate records, causing notification and regulatory costs Correct answer.
  3. The organization has weak security culture
  4. Cyber risk is increasing across the industry

Explanation

A well-formed scenario names a specific threat community, the asset and the action taken against it, and the resulting loss. That structure lets the analyst estimate each factor in the ontology rather than speculate about general conditions.

Question 40Risk Analysis (Open FAIR)

An analyst is unsure whether the threat community's contact frequency is 5 or 50 per year. What is the most defensible Open FAIR response?

  1. Capture the uncertainty as a calibrated range spanning both values and let the model propagate it Correct answer.
  2. Omit contact frequency from the analysis until better data arrives
  3. Use the lower figure to avoid alarming executives
  4. Use the higher figure so the analysis is conservative

Explanation

Open FAIR is built to carry uncertainty, so an analyst expresses a plausible range with an associated confidence rather than choosing an arbitrary endpoint. The simulation then propagates that uncertainty into the loss exposure results.

Question 41Risk Analysis (Open FAIR)

What distinguishes primary loss from secondary loss in an Open FAIR analysis of a payment card breach?

  1. Primary loss is measured in events per year; secondary loss is measured in currency
  2. Primary loss is the response cost borne by the organization, such as investigation and customer notification; secondary loss is the cost borne by other parties, such as fines and card brand penalties Correct answer.
  3. Primary loss occurs first in time and secondary loss occurs only in the following fiscal year
  4. Primary loss is the cost of the controls; secondary loss is the cost of the audit

Explanation

Primary loss is the direct response cost the organization incurs for the event, while secondary loss is the consequence felt by other parties, such as regulators, customers, or business partners. Keeping the two separate lets analysts reason about different stakeholders and different response actions.

Question 42Risk Analysis (Open FAIR)

An organization estimates a loss event frequency of 6 per year and an average loss magnitude of 100,000 per event. What is the annualized loss exposure?

  1. 6,100,000
  2. 600,000 Correct answer.
  3. 16,667
  4. 100,006

Explanation

Annualized loss exposure is the product of loss event frequency and loss magnitude, so 6 events per year times 100,000 per event equals 600,000. This expected annual figure is the standard summary of a scenario's risk.

Question 43Risk Analysis (Open FAIR)

Which statement correctly explains why Open FAIR requires the analyst to identify a specific threat community rather than a generic 'cyber threat'?

  1. Generic threats are prohibited by the Open FAIR ontology under all circumstances
  2. Threat communities are used only to assign ownership of the asset
  3. Threat communities determine the discount rate applied to future losses
  4. A specific threat community allows contact frequency, probability of action, and capability to be estimated meaningfully Correct answer.

Explanation

Different threat communities have very different contact frequencies, willingness to act, and capabilities, so aggregating them into a generic threat makes the estimates uninterpretable. Naming the community lets the analyst estimate each factor with evidence relevant to that actor.

Question 44Risk Analysis (Open FAIR)

A control that reduces the number of threat events reaching an asset without changing the asset's resistance would most directly affect which Open FAIR factor?

  1. Loss magnitude
  2. Asset value
  3. Threat event frequency Correct answer.
  4. Secondary loss

Explanation

Reducing how often threat events reach the asset changes threat event frequency, which then lowers loss event frequency through the model. Controls that block or deflect attempts act on the likelihood side rather than on impact.

Question 45Risk Analysis (Open FAIR)

An analyst must estimate resistance strength for an asset protected by layered controls. Which approach is most consistent with Open FAIR?

  1. Assess how much the combined controls reduce the likelihood of a threat event succeeding, expressed as a calibrated estimate Correct answer.
  2. Assume resistance strength equals the strongest single control in the stack
  3. Count the number of controls and use that count as the resistance strength value
  4. Use the vendor's published effectiveness rating for the newest control

Explanation

Resistance strength describes how well the asset withstands a threat event, so layered controls must be judged by their combined effect rather than by counting or picking one component. The result is a calibrated estimate that feeds into vulnerability.

Question 46Risk Analysis (Open FAIR)

Why does Open FAIR recommend that the analyst first define the risk scenario before estimating any factor?

  1. Because the scenario replaces the need for calibrated estimation
  2. Because the scenario wording determines which simulation software may be used
  3. Because the scenario fixes the threat, asset, and effect, which gives each factor estimate a clear referent Correct answer.
  4. Because the scenario must be approved by the board before analysis begins

Explanation

The scenario anchors the analysis by naming the threat community, the asset, and the loss effect, which prevents factor estimates from drifting between different interpretations. Without that anchor, estimates of frequency and magnitude cannot be combined coherently.

Question 47Risk Analysis (Open FAIR)

An analyst observes that a threat community's capability is far below the asset's resistance strength. What does Open FAIR imply about vulnerability?

  1. Vulnerability equals the threat event frequency
  2. Vulnerability is undefined until a loss occurs
  3. Vulnerability approaches one because the threat is persistent
  4. Vulnerability approaches zero because threat events are unlikely to succeed Correct answer.

Explanation

Vulnerability is the likelihood that a threat event becomes a loss event, and it falls as resistance strength exceeds threat capability. A large gap in the asset's favor therefore drives vulnerability toward zero and suppresses loss event frequency.

Question 48Risk Analysis (Open FAIR)

A risk committee asks why the analysis reports a distribution of annual loss rather than a single number. Which justification is most consistent with Open FAIR?

  1. Inputs such as threat event frequency and loss magnitude are uncertain, so the output is a distribution that shows both expected loss and the probability of extreme outcomes Correct answer.
  2. Distributions are required because auditors mandate them for all risk registers
  3. A single number cannot be stored in a risk register
  4. Distributions eliminate the need to calibrate the input estimates

Explanation

Open FAIR treats the factors as uncertain quantities expressed as calibrated ranges, and combining them yields a loss distribution rather than a point value. That output lets decision makers see expected loss and tail probabilities together.

Question 49Risk Analysis (Open FAIR)

Two analysts model the same scenario. Analyst A estimates threat event frequency from incident ticket counts only; Analyst B combines ticket counts with subject matter expert calibration and external threat intelligence. Which statement best reflects Open FAIR practice?

  1. Analyst A's approach is preferable because ticket data is objective and complete
  2. Both approaches are equivalent because the scenario is identical
  3. Neither approach is valid without a full quantitative dataset covering several years
  4. Analyst B's approach is preferable because Open FAIR favors calibrated estimates drawing on multiple evidence sources Correct answer.

Explanation

Open FAIR emphasizes calibrated estimation that triangulates available evidence, including data, expert judgment, and external intelligence, because no single source captures the full threat picture. Ticket counts alone typically undercount unreported or undetected events.

Question 50Risk Analysis (Open FAIR)

An organization is deciding between two controls: one that lowers the frequency of successful attacks and one that reduces the cost per incident. How should an Open FAIR analysis compare them?

  1. Model each control as a change to the factor it affects, then compare the resulting annualized loss exposure reduction against the control's cost Correct answer.
  2. Compare the purchase prices of the two controls and select the cheaper one
  3. Compare the controls using their vendor-assigned maturity levels
  4. Select the control that addresses the larger number of threat communities

Explanation

The two controls act on different sides of the risk equation, so each must be modeled as a change to the specific factor it influences and the resulting risk reduction compared with cost. This gives a defensible basis for choosing between likelihood and impact interventions.