CAS-004 Governance, Risk, and Compliance Practice Question
A security analyst is performing a quantitative risk assessment for a server that processes payment card data. The server has an asset value of $50,000. Based on historical data, the exposure factor (EF) for a ransomware attack is 80%, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?
⚠ Common exam trap
CAS-005 often tests confusion between SLE and ALE, or misapplication of the formula by forgetting to multiply by ARO or using AV directly instead of SLE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$20,000
The Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). SLE is Asset Value (AV) times Exposure Factor (EF). Here, AV = $50,000, EF = 0.8, so SLE = $40,000. ARO = 0.5, so ALE = $40,000 * 0.5 = $20,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
$20,000
Why this is correct
SLE equals asset value ($50,000) multiplied by exposure factor (0.80), giving $40,000. ALE is SLE multiplied by ARO (0.5), yielding $20,000. This quantifies expected annual loss for the payment card server, satisfying the quantitative assessment requirement.
- ✗
$40,000
Why it's wrong here
$40,000 is the single loss expectancy (SLE): $50,000 asset value multiplied by the 0.8 exposure factor. ALE requires multiplying SLE by the 0.5 ARO, giving $20,000. SLE is tempting because it is the intermediate figure the calculation produces first.
- ✗
$50,000
Why it's wrong here
$50,000 is the full asset value, ignoring both the 80% exposure factor and the 0.5 annualised rate of occurrence. ALE is SLE ($40,000) multiplied by ARO (0.5), yielding $20,000. The asset value is tempting because it is the largest, most prominent figure in the stem.
- ✗
$25,000
Why it's wrong here
$25,000 halves the asset value, which matches neither the exposure factor nor the ARO. ALE is $50,000 times 0.8 times 0.5, equalling $20,000. The figure is tempting because 0.5 appears in the stem and invites a simple halving of the asset value.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.