hardMultiple Select
CRISC Practice Question: A risk assessment team is calculating the Annual…
A risk assessment team is calculating the Annual Loss Expectancy (ALE) for a critical server. The Single Loss Expectancy (SLE) is $50,000 and the Annual Rate of Occurrence (ARO) is estimated to be 2. The team is considering implementing a new backup solution costing $40,000 per year. Which TWO of the following statements are true regarding the cost-benefit analysis? (Select TWO.)
⚠ Common exam trap
The trap here is that candidates mistakenly assume the backup cost is subtracted directly from the current ALE to get a net benefit, ignoring that the control reduces but does not eliminate the risk, and that the payback period requires knowing the actual annual benefit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The backup is cost-effective if the ALE reduction exceeds the annual cost.
Option E is correct because ALE is calculated as SLE × ARO, so $50,000 × 2 = $100,000, which is the current annualized loss exposure before any control is applied. Option B is correct because a safeguard is justified when its annual cost is less than the ALE reduction it produces; the backup costs $40,000 per year, so it is cost-effective only if it lowers the ALE by more than that amount. Option A is not correct because the net benefit cannot be stated as $60,000 without knowing the reduced ALE after the backup; $100,000 minus $40,000 is not the net benefit. Option C is not correct because the post-control ALE is the residual SLE × ARO after mitigation, not the original ALE minus the backup cost. Option D is not correct because no payback period can be determined from the given data; it would require the actual loss reduction and possibly the initial versus recurring cost structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The net benefit of the backup is $60,000 per year.
Why it's wrong here
The $60,000 figure misapplies the ALE formula: ALE is SLE × ARO = $100,000, and net benefit is ALE minus control cost, giving $60,000 only if the backup eliminated all risk. It tempts because ALE arithmetic is the standard basis for justifying controls, but here residual risk is unstated.
- ✓
The backup is cost-effective if the ALE reduction exceeds the annual cost.
Why this is correct
Cost-benefit compares the annual cost of the control against the reduction in ALE it delivers. The backup is justified only when that ALE reduction exceeds $40,000 per year; otherwise the control costs more than the risk it mitigates.
- ✗
The ALE after implementing the backup is $100,000 minus the backup cost.
Why it's wrong here
ALE is SLE multiplied by ARO, giving $100,000 before controls; the backup's $40,000 annual cost is compared against that figure, not subtracted from it to produce a post-implementation ALE. The tempting error is treating cost as reducing loss exposure. Residual ALE depends on the new ARO after the control, not on the control's price.
- ✗
The payback period for the backup is one year.
Why it's wrong here
Payback compares the $40,000 annual cost against the $100,000 ALE reduction, giving 0.4 years, not one. It tempts because payback is a valid cost-benefit metric, and would be correct had the stem supplied figures producing a one-year recovery.
- ✓
The current ALE without backup is $100,000.
Why this is correct
ALE equals SLE multiplied by ARO, so $50,000 times 2 gives $100,000 annual expected loss. This figure is the baseline against which the $40,000 yearly backup cost is compared, establishing whether the control's benefit exceeds its expense.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 1,062 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.