IT Risk Assessment →mediumMultiple ChoiceObjective-mapped

CRISC IT Risk Assessment Practice Question

An organization calculates the annualized loss expectancy (ALE) for a cyber attack scenario. The single loss expectancy (SLE) is $50,000 and the annualized rate of occurrence (ARO) is 2. What is the ALE?

⚠ Common exam trap

A common mix-up: candidates confuse the relationship between SLE and ARO, mistakenly dividing instead of multiplying, or misapplying the ARO as a squared term, leading to incorrect ALE values like $25,000 or $200,000.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

$100,000

The annualized loss expectancy (ALE) is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Given an SLE of $50,000 and an ARO of 2, the ALE is $50,000 × 2 = $100,000. This is the expected financial loss from the cyber attack scenario over one year.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
$25,000
Why it's wrong here
This would be SLE / ARO, not product.
✗
$50,000
Why it's wrong here
This is the SLE value.
✗
$200,000
Why it's wrong here
This would be ARO × SLE × 2 incorrectly.
✓
$100,000
Why this is correct
ALE = ARO × SLE = 2 × $50,000 = $100,000.

Go deeper

CRISC IT Risk Assessment Practice Question

Why each option matters

Option-by-option breakdown

Related to this question