CISM Information Security Risk Management Practice Question
A global insurance provider has just completed a quantitative risk assessment for a new claims-processing application. The assessment used the Annualized Loss Expectancy (ALE) formula and produced an ALE of $850,000 for the risk of a data breach. The vendor's proposed control has an Annualized Cost of the Safeguard (ACS) of $300,000 and a projected risk reduction of 60%. The CISO asks the information security manager to determine the cost-benefit of implementing this control. What is the net benefit (or loss) of the control?
⚠ Common exam trap
Many candidates confuse residual ALE or gross risk reduction with net benefit, and omitting the ACS from the calculation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$210,000 net benefit
The control reduces the ALE by 60%, leaving a residual ALE of $340,000. The value of that reduction is $510,000. After deducting the $300,000 annual safeguard cost, the net benefit is $210,000. This demonstrates a positive return and supports implementing the control, provided the quantitative assumptions are validated and the risk remains within tolerance.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
$210,000 net benefit
Why this is correct
The control reduces ALE by 60%, so the mitigated ALE is $850,000 × 40% = $340,000. The risk reduction value is $850,000 − $340,000 = $510,000. Subtracting the ACS of $300,000 yields a net benefit of $210,000. This is the correct calculation of value delivered after control cost.
- ✗
$510,000 net benefit
Why it's wrong here
This figure represents the gross risk reduction value before subtracting the ACS. It ignores the $300,000 cost of the safeguard. Net benefit requires comparing the risk reduction against the control cost, so reporting $510,000 overstates the financial justification for the control and could mislead the CISO's investment decision.
- ✗
$340,000 net benefit
Why it's wrong here
This is the residual ALE after applying the 60% risk reduction, not the net benefit. Residual risk is a measure of remaining exposure, while net benefit compares risk reduction value to control cost. Confusing residual ALE with net benefit leads to an inaccurate cost-benefit conclusion for the proposed safeguard.
- ✗
$550,000 net loss
Why it's wrong here
This would imply the control costs more than the risk it mitigates, but the ACS is only $300,000 and the mitigated ALE is $340,000. A net loss occurs only when the ACS exceeds the risk reduction value. Here the reduction value is larger, so this figure is incorrect and would wrongly discourage a beneficial control.
Go deeper
Related to this question
About these practice questions
One of 924 original CISM practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.