CRISC IT Risk Assessment Practice Question
A risk analyst at a healthcare provider is assessing the risk of a ransomware attack on a clinical data repository. The analyst estimates that a ransomware event would cost $800,000 in recovery and downtime, and that such an event is likely to occur once every four years. What is the annualized loss expectancy (ALE) for this risk?
⚠ Common exam trap
It's easy for candidates to confuse single loss expectancy with annualized loss expectancy, or inverting the recurrence interval instead of converting it to an annualized rate of occurrence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$200,000
Annualized loss expectancy expresses expected yearly loss as single loss expectancy multiplied by annualized rate of occurrence. With an $800,000 single loss and a four-year recurrence, the ARO is 0.25, producing an ALE of $200,000. This normalized annual figure lets the healthcare provider compare the ransomware risk directly against other risks and against the cost of proposed controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$800,000
Why it's wrong here
$800,000 is the single loss expectancy, the estimated cost of one ransomware event. It does not account for how often the event is expected to occur. ALE requires multiplying SLE by the annualized rate of occurrence, so reporting the raw single-event cost overstates the annualized exposure and would mislead control investment decisions.
- ✗
$3,200,000
Why it's wrong here
This figure results from multiplying the $800,000 loss by four years rather than dividing by the four-year recurrence interval. ALE uses the annualized rate of occurrence, which is 0.25 here, not 4. Multiplying instead of using the correct ARO inflates the expected annual loss and would wrongly justify disproportionate spending on controls.
- ✓
$200,000
Why this is correct
ALE is calculated as single loss expectancy (SLE) multiplied by annualized rate of occurrence (ARO). Here SLE is $800,000 and ARO is 0.25 (once every four years), so ALE = $800,000 × 0.25 = $200,000. This is the expected annual loss from the ransomware risk and is the correct value for prioritizing treatment options.
- ✗
$100,000
Why it's wrong here
This value would be correct only if the event occurred once every eight years, giving an ARO of 0.125. The scenario states once every four years, so the annualized rate of occurrence is 0.25. Using the wrong frequency halves the expected annual loss and understates the risk, potentially leading to underinvestment in ransomware defenses.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.