CRISC IT Risk Assessment Practice Question
In the FAIR framework, which of the following correctly represents the calculation of Loss Event Frequency (LEF)?
⚠ Common exam trap
Many exam-takers confuse LEF with ALE or mistakenly think vulnerability is additive, leading them to choose Option B or D, but FAIR explicitly defines LEF as a product of TEF and vulnerability, not a sum or a monetary metric.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
LEF = Threat Event Frequency × Vulnerability
In the FAIR (Factor Analysis of Information Risk) framework, Loss Event Frequency (LEF) is calculated as the product of Threat Event Frequency (TEF) and Vulnerability (Vuln). This reflects that the frequency of loss events depends on how often a threat event occurs and the probability that the threat event will result in a loss, which is the vulnerability component. The multiplication captures the dependency: even if threats are frequent, low vulnerability reduces LEF, and vice versa.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
LEF = Threat Event Frequency × Vulnerability
Why this is correct
Correct formula.
- ✗
LEF = Threat Event Frequency + Vulnerability
Why it's wrong here
Addition is not correct; LEF is a product.
- ✗
LEF = Asset Value × Vulnerability
Why it's wrong here
That relates to loss magnitude, not frequency.
- ✗
LEF = Annualized Rate of Occurrence × Single Loss Expectancy
Why it's wrong here
That is ALE, not LEF.
Go deeper
Related to this question
About these practice questions
One of 983 original CRISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CRISC practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CRISC exam.