Information Security Risk Management →hardMultiple ChoiceObjective-mapped

CISM Information Security Risk Management Practice Question

An organization is implementing a quantitative risk analysis for a critical application. The asset value is $2,000,000. The exposure factor (EF) is 0.25, and the annualized rate of occurrence (ARO) is 0.5. What is the annualized loss expectancy (ALE)?

⚠ Common exam trap

The trap here is that candidates often forget to multiply by the ARO after computing SLE, or they confuse ARO with a percentage and incorrectly apply it as a divisor instead of a multiplier.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

$250,000

The annualized loss expectancy (ALE) is calculated as ALE = AV × EF × ARO, where AV is the asset value ($2,000,000), EF is the exposure factor (0.25), and ARO is the annualized rate of occurrence (0.5). Multiplying these gives $2,000,000 × 0.25 × 0.5 = $250,000, which represents the expected annual financial loss from this risk.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
$250,000
Why this is correct
ALE = $2,000,000 × 0.25 × 0.5 = $250,000.
✗
$1,000,000
Why it's wrong here
This results from using ARO=2 instead of 0.5.
✗
$125,000
Why it's wrong here
This would be if EF=0.125 or ARO=0.25.
✗
$500,000
Why it's wrong here
This is asset value × EF, ignoring ARO.

Go deeper

CISM Information Security Risk Management Practice Question

Why each option matters

Option-by-option breakdown

Related to this question