Quantitative risk assessment is correct because the question calls out numeric metrics such as single loss expectancy SLE annual rate of occurrence ARO and annual loss expectancy ALE which are the core measures used in a quantitative approach.

A quantitative risk assessment calculates numeric values to estimate potential losses. SLE is the monetary loss from a single event and is typically computed as asset value multiplied by an exposure factor. ARO is the expected frequency of the event in a year. ALE is the product of SLE and ARO and gives an annualized expected loss which helps prioritize risks and justify controls.

Threat modeling is incorrect because threat modeling focuses on identifying assets threats attack paths and mitigations rather than producing numeric loss estimates like SLE ARO and ALE.

Qualitative risk assessment is incorrect because a qualitative approach uses descriptive rankings such as high medium and low to assess likelihood and impact instead of calculating numeric loss values.

Cost benefit analysis is incorrect because it compares the costs of controls to their expected benefits and may use monetary figures but it is not the standard term for the risk evaluation method that specifically uses SLE ARO and ALE which is quantitative risk assessment.

Full AWS Practitioner Certification Question