The correct answers are A. Likelihood and D. Impact.
A risk matrix commonly calculates or represents risk using likelihood and impact. Likelihood measures the probability that a threat or risk event will occur. Impact measures the severity of the consequences if the event occurs. Together, they help determine the overall risk rating, such as low, medium, high, or critical.
For example:
Risk = Likelihood × Impact
Why the other options are incorrect:
B. Quantitative
Quantitative describes a type of risk analysis that uses numerical or monetary values. It is not one of the two standard matrix factors.
C. SLE
Single Loss Expectancy is used in quantitative risk calculations. It estimates the cost of a single incident.
E. ALE
Annualized Loss Expectancy is used in quantitative risk analysis and is commonly calculated as SLE × ARO.
F. ARO
Annualized Rate of Occurrence estimates how often an event is expected to happen per year. It is also used in quantitative risk calculations.
Therefore, the two metrics used in a risk matrix are likelihood and impact.
