CISM Information Security Risk Management Practice Question
In a risk assessment, a CISM calculates the annualized loss expectancy (ALE) for a specific threat. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 0.2. What is the ALE, and which risk response is most cost-effective if a control costs $12,000 per year and reduces ARO to 0.05?
⚠ Common exam trap
The trap here is that candidates often compare the control cost to the original ALE ($10,000) or to the residual ALE ($2,500) instead of comparing it to the reduction in ALE ($7,500), leading to incorrect cost-justification conclusions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accept the risk because the control is not cost-justified.
The ALE is calculated as SLE × ARO = $50,000 × 0.2 = $10,000. After implementing the control costing $12,000 per year, the residual ALE is $50,000 × 0.05 = $2,500. The annual cost of the control ($12,000) exceeds the reduction in ALE ($10,000 - $2,500 = $7,500), so the control is not cost-justified. Therefore, accepting the risk is the most cost-effective response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Accept the risk because the control is not cost-justified.
Why this is correct
The cost of control is greater than the risk reduction benefit, so acceptance is appropriate.
- ✗
Accept the risk because ALE after control is only $2,500.
Why it's wrong here
The current ALE is $10,000, not $2,500; acceptance is based on cost-benefit analysis.
- ✗
Implement the control because it reduces ALE to $2,500.
Why it's wrong here
The control cost ($12,000) exceeds the reduction in ALE ($7,500), so it is not cost-effective.
- ✗
Implement the control because ALE is $10,000, and control cost is only $12,000.
Why it's wrong here
The control cost should be compared to risk reduction ($7,500), not full ALE.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISM question from scratch — 871 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISM practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISM exam.