CISM Information Security Risk Management Practice Question
An organization calculates that the single loss expectancy (SLE) for a server failure is $10,000, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?
⚠ Common exam trap
A common mix-up: candidates confuse ALE with SLE or incorrectly apply the ARO as a multiplier greater than 1, leading to answers like $20,000, instead of recognizing that an ARO of 0.5 means the loss is halved annually.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$5,000
The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $10,000 and an ARO of 0.5, the ALE is $10,000 × 0.5 = $5,000. This represents the expected annual financial loss from server failures based on the frequency and impact of such events.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
$5,000
Why this is correct
ALE is derived by multiplying single loss expectancy by annualised rate of occurrence: $10,000 × 0.5 = $5,000. This quantifies the expected yearly financial loss from server failure, giving management a monetary figure for comparing against the cost of countermeasures.
- ✗
$10,000
Why it's wrong here
ALE is SLE multiplied by ARO, so $10,000 × 0.5 gives $5,000, not the SLE itself. Restating the single loss expectancy ignores the frequency component entirely. SLE is the correct figure only when calculating the loss from one incident, before annualising by occurrence rate.
- ✗
$20,000
Why it's wrong here
Multiplying SLE by 2 inverts the ARO relationship; ARO of 0.5 means the event occurs once every two years, halving the annual exposure. $20,000 would result only from an ARO of 2.0. The ARO must multiply SLE directly, yielding $5,000.
- ✗
$2,500
Why it's wrong here
Dividing SLE by 4 has no basis in the ALE formula, which multiplies SLE by ARO. $2,500 would require an ARO of 0.25. The stated ARO of 0.5 produces $5,000 annually. This figure confuses the calculation with an unrelated ratio.
About these practice questions
Courseiva writes every CISM question from scratch — 924 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.