CRISC IT Risk Assessment Practice Question
A quantitative risk assessment for a server shows an ARO of 0.5 and SLE of $200,000. What is the ALE, and what does it imply?
⚠ Common exam trap
CRISC often tests the confusion between SLE and ALE, and between ARO and its inverse — candidates who multiply SLE by 2 instead of 0.5 land on $400,000.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ALE = $100,000; expected annual loss
ALE (Annualized Loss Expectancy) is calculated as ARO × SLE. With an ARO of 0.5 (the event is expected to occur once every two years) and an SLE of $200,000, the ALE is 0.5 × $200,000 = $100,000. This figure represents the expected average annual financial loss from this risk, which is the value used to justify the cost of controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ALE = $400,000; maximum possible loss
Why it's wrong here
Multiplying ARO by SLE gives $100,000, not $400,000; that value would require an ARO of 2. ALE is also expected annual loss, not maximum possible loss. It is tempting because larger numbers feel like worst-case exposure, but ALE is an average, not a ceiling.
- ✗
ALE = $100,000; single loss expectancy
Why it's wrong here
The arithmetic $100,000 is right, but the implication is wrong: ALE is annualised loss expectancy, the expected yearly loss from the risk. It is tempting because $100,000 correctly equals 0.5 × $200,000, yet labelling it single loss expectancy confuses ALE with SLE, which is the per-incident figure.
- ✓
ALE = $100,000; expected annual loss
Why this is correct
Multiplying ARO 0.5 by SLE $200,000 yields an ALE of $100,000, representing the expected annual loss from this risk. This satisfies the stem's quantitative requirement, giving management a monetary figure to compare against control costs when prioritising remediation.
- ✗
ALE = $200,000; annual cost of controls
Why it's wrong here
ALE is ARO multiplied by SLE, giving $100,000, not $200,000; $200,000 is the SLE itself. The figure also mislabels the result as control cost. It is tempting because SLE appears in the calculation, but ALE expresses expected annual loss, not the price of implementing safeguards.
Go deeper
Related to this question
About these practice questions
This CRISC question is part of Courseiva's 1,062-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.