CAS-004 Governance, Risk, and Compliance Practice Question
A security analyst is calculating the annualized loss expectancy (ALE) for a server that processes credit card data. The server has a $100,000 asset value, and the exposure factor for a security breach is 0.4. Historical data shows that such breaches occur twice per year. What is the ALE?
⚠ Common exam trap
CAS-005 often tests whether candidates confuse SLE with ALE or forget to multiply by ARO; the trap is stopping at $40,000 or using the full asset value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$80,000
ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE = Asset Value × Exposure Factor = $100,000 × 0.4 = $40,000. ARO = 2 occurrences per year. Therefore ALE = $40,000 × 2 = $80,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$100,000
Why it's wrong here
ALE is single loss expectancy multiplied by annualised rate of occurrence: $100,000 × 0.4 × 2 = $80,000, so $100,000 misstates the asset value as the annual figure. It is tempting because the asset value is the largest number given, and it would be correct if the question asked for asset value rather than ALE.
- ✗
$40,000
Why it's wrong here
This computes single loss expectancy ($100,000 × 0.4 = $40,000) and omits the annualised rate of occurrence. ALE requires multiplying SLE by the annualised rate of occurrence (two breaches per year), giving $80,000. The $40,000 figure is the correct answer only when calculating SLE for a single incident.
- ✓
$80,000
Why this is correct
SLE equals asset value multiplied by exposure factor: $100,000 × 0.4 = $40,000. ALE equals SLE multiplied by annualised rate of occurrence: $40,000 × 2 = $80,000. This matches the calculated annualised loss expectancy for the credit card server.
- ✗
$200,000
Why it's wrong here
ALE is $100,000 × 0.4 × 2 = $80,000; $200,000 wrongly multiplies the full asset value by the occurrence rate, ignoring the 0.4 exposure factor. It is tempting because it uses the two prominent figures, and it would be correct if the exposure factor were 1.0.
About these practice questions
This CAS-005 question is part of Courseiva's 973-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.