CRISC IT Risk Assessment Practice Question
A risk analyst is evaluating a critical customer database. The asset value is $2,000,000; the exposure factor if the database is compromised is 40%. The annualized rate of occurrence (ARO) for a successful breach is estimated at 0.25. What is the annualized loss expectancy (ALE)?
⚠ Common exam trap
Test-takers frequently confuse SLE with ALE and stopping the calculation before applying the annualized rate of occurrence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$200,000
ALE is calculated as SLE × ARO. Here SLE = $2,000,000 × 0.40 = $800,000, and ARO = 0.25, so ALE = $800,000 × 0.25 = $200,000. This quantitative metric helps the risk practitioner compare the expected annual loss of this risk against other risks and against the cost of potential controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$800,000
Why it's wrong here
$800,000 is the single loss expectancy (SLE), not the ALE. It reflects the loss from one successful event ($2,000,000 × 0.40), but the question asks for the annualized figure. The ALE must further incorporate the estimated frequency of 0.25 events per year to express the expected annual loss.
- ✓
$200,000
Why this is correct
SLE is $2,000,000 × 0.40 = $800,000. ALE = SLE × ARO = $800,000 × 0.25 = $200,000. This represents the expected annual loss from this specific risk before any controls are applied, which is the correct quantitative output for prioritizing the risk against other assessed risks.
- ✗
$2,000,000
Why it's wrong here
This is the full asset value, which ignores both the exposure factor and the annualized rate of occurrence. Using total asset value as the loss estimate overstates the expected annual impact because not all of the asset would be lost in a single event, and the event is not expected to occur every year.
- ✗
$500,000
Why it's wrong here
This figure would result from dividing the asset value by the exposure factor (or similar misordering), not from multiplying SLE by ARO. It does not represent the expected annual loss. In CRISC quantitative analysis, ALE must combine the single loss expectancy with the annualized rate of occurrence for the specific threat event.
Go deeper
Related to this question
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.