hardMultiple SelectObjective-mapped
CRISC Practice Question: A risk assessment team is calculating the Annual…
A risk assessment team is calculating the Annual Loss Expectancy (ALE) for a critical server. The Single Loss Expectancy (SLE) is $50,000 and the Annual Rate of Occurrence (ARO) is estimated to be 2. The team is considering implementing a new backup solution costing $40,000 per year. Which TWO of the following statements are true regarding the cost-benefit analysis? (Select TWO.)
⚠ Common exam trap
The trap here is that candidates mistakenly assume the backup cost is subtracted directly from the current ALE to get a net benefit, ignoring that the control reduces but does not eliminate the risk, and that the payback period requires knowing the actual annual benefit.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The backup is cost-effective if the ALE reduction exceeds the annual cost.
A cost-benefit analysis for a risk mitigation measure like a backup solution requires that the reduction in ALE (the benefit) exceed the annual cost of the control. Here, the current ALE is $100,000 (SLE $50,000 × ARO 2). If the backup reduces the ALE by more than $40,000 per year, it is cost-effective. Option E is correct because the current ALE without backup is indeed $50,000 × 2 = $100,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The net benefit of the backup is $60,000 per year.
Why it's wrong here
Net benefit cannot be calculated without knowing the ALE reduction.
- ✓
The backup is cost-effective if the ALE reduction exceeds the annual cost.
Why this is correct
Cost-effectiveness is determined by comparing risk reduction to cost.
- ✗
The ALE after implementing the backup is $100,000 minus the backup cost.
Why it's wrong here
ALE after control depends on new SLE/ARO, not simply subtracting cost.
- ✗
The payback period for the backup is one year.
Why it's wrong here
Payback period requires investment cost and annual savings, not given.
- ✓
The current ALE without backup is $100,000.
Why this is correct
ALE = SLE * ARO = $50,000 * 2 = $100,000.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CRISC question from scratch — 983 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.