ISC2 CISSP Practice Question

The correct answer is to rank risks based on potential impact and likelihood of occurrence. This approach represents the fundamental principle of risk prioritization in a risk management framework. By evaluating both the potential impact (how severe the consequences would be) and the likelihood (probability of occurrence), the organization can create a meaningful prioritization that addresses the most significant threats first.

The other options are flawed approaches to risk prioritization:

Addressing high-impact risks based on their severity ignores the probability component of risk evaluation, which could lead to wasting resources on very unlikely scenarios while neglecting more probable moderate-impact risks.

Prioritizing risks based on implementation costs focuses on the treatment aspect before proper prioritization and fails to consider the fundamental risk characteristics of impact and likelihood.

Ranking risks alphabetically by affected system is an arbitrary method that has no correlation to the actual severity or importance of the risks.