CRISC IT Risk Assessment Practice Question
An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?
⚠ Common exam trap
A common mix-up: candidates confuse the relationship between SLE and ARO, mistakenly dividing instead of multiplying, or misapplying the ARO as a squared term, leading to incorrect ALE values like $25,000 or $200,000.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$100,000
The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$25,000
Why it's wrong here
Dividing SLE by ARO produces $25,000, but ALE is SLE multiplied by ARO, giving $100,000. It is tempting because the two figures invite division, yet that operation yields a per-incident average, not the annualised expected loss the formula defines.
- ✗
$50,000
Why it's wrong here
Returning the SLE unchanged ignores the ARO of 2, so the annualised figure is understated; ALE is SLE multiplied by ARO, giving $100,000. It is tempting because SLE is the headline loss figure, yet ALE must aggregate expected occurrences across the year.
- ✗
$200,000
Why it's wrong here
Multiplying SLE by 4 rather than the stated ARO of 2 overstates the result; ALE is SLE ($50,000) times ARO (2), giving $100,000. It is tempting because larger products feel conservative, yet the calculation must use the given frequency exactly.
- ✓
$100,000
Why this is correct
Annualized loss expectancy equals single loss expectancy multiplied by annualized rate of occurrence: $50,000 × 2 = $100,000. This quantifies the expected yearly loss for the scenario, giving risk practitioners the figure used to compare against the cost of proposed controls.
About these practice questions
One of 1,062 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.