CAS-004 Governance, Risk, and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Loss Magnitude (LM)

  Why this is correct

  Loss Magnitude quantifies the financial impact of a single loss event across primary and secondary forms. It is a primary FAIR factor, paired with Loss Event Frequency to derive annualised risk exposure in the model.

• ✗

  Single Loss Expectancy (SLE)

  Why it's wrong here

  SLE is a component of traditional ALE calculations, not of the FAIR ontology, which instead uses primary loss and secondary loss factors. It tempts because SLE quantifies per-event loss, but FAIR decomposes magnitude differently, so SLE is not a primary FAIR component.

• ✗

  Annual Loss Expectancy (ALE)

  Why it's wrong here

  ALE is a quantitative output of traditional annualised loss calculations, not a FAIR primary component; FAIR decomposes risk into loss event frequency and loss magnitude factors. It tempts because ALE is a familiar risk metric, but FAIR analysis derives its own factor taxonomy rather than using ALE as an input.

• ✓

  Loss Event Frequency (LEF)

  Why this is correct

  Loss Event Frequency estimates how often a threat agent successfully acts against an asset within a given timeframe, combining threat event frequency with vulnerability. It is a primary FAIR factor, feeding directly into risk calculation alongside Loss Magnitude.

• ✗

  Annualized Rate of Occurrence (ARO)

  Why it's wrong here

  ARO belongs to classic quantitative risk formulas, not FAIR's factor model, which uses loss event frequency and loss magnitude. It tempts because ARO sounds like a frequency measure, but FAIR expresses occurrence through vulnerability and threat event frequency instead of an annualised rate.

Go deeper

Related to this question