CRISC Information Technology and Security Practice Question
A risk manager is using the FAIR model to quantify cyber risk. After analyzing a ransomware scenario, the probable loss event frequency (LEF) is estimated at 0.2 per year, and the probable loss magnitude (LM) is $5 million. What is the annualized loss expectancy (ALE) in this scenario?
⚠ Common exam trap
CRISC often tests whether candidates can correctly apply the ALE formula and avoid confusing it with LM alone or misapplying the frequency — the trap is picking the Loss Magnitude ($5M) or miscalculating the multiplication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$1,000,000
Annualized Loss Expectancy (ALE) is calculated as Loss Event Frequency (LEF) multiplied by Loss Magnitude (LM). Here, LEF = 0.2 per year and LM = $5,000,000, so ALE = 0.2 × $5,000,000 = $1,000,000. This represents the expected annualized financial loss from the ransomware scenario.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$500,000
Why it's wrong here
This figure treats loss magnitude as though it were $2.5 million, or divides the correct product again. ALE is LEF multiplied by LM, giving $1 million here; $500,000 corresponds to a frequency of 0.1 or a magnitude of $2.5 million, neither of which the scenario states.
- ✗
$250,000
Why it's wrong here
This halves the correct result, implying a loss magnitude of $1.25 million rather than the stated $5 million. Multiplying LEF 0.2 by LM $5 million yields $1 million annualised; $250,000 would require a frequency of 0.05 at that magnitude.
- ✗
$5,000,000
Why it's wrong here
ALE is LEF multiplied by LM: 0.2 × $5 million = $1 million. Quoting the raw loss magnitude ignores the 0.2 annual frequency, overstating expected yearly loss fivefold. It is tempting because $5 million is the single-event figure the scenario supplies, and it would be the correct answer if the question asked for loss magnitude rather than annualised expectancy.
- ✓
$1,000,000
Why this is correct
Multiplying loss event frequency (0.2) by loss magnitude ($5 million) yields $1,000,000 annualised loss expectancy, satisfying the FAIR requirement to express risk as a monetary annual figure. This correctly applies the ALE formula, giving the risk manager a quantified basis for comparing the ransomware scenario against other risks.
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISACA exam blueprint
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.