CISSP Security and Risk Management Practice Question
A security analyst is evaluating the risk of a data breach in a healthcare organization. The asset value of the patient database is $500,000, and the exposure factor is 0.2. The annual rate of occurrence is estimated at 0.1. What is the annualized loss expectancy (ALE)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$10,000
ALE = ARO × SLE, and SLE = AV × EF = $500,000 × 0.2 = $100,000. Then ALE = 0.1 × $100,000 = $10,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
$10,000
Why this is correct
This option correctly calculates the Annualized Loss Expectancy (ALE) using the formula ALE = SLE × ARO. With an Asset Value (AV) of $500,000 and an Exposure Factor (EF) of 0.20, the Single Loss Expectancy (SLE) is $100,000. Multiplying this SLE by the Annualized Rate of Occurrence (ARO) of 0.10 yields the correct annualized risk value of $10,000.
- ✗
$5,000
Why it's wrong here
This option is incorrect because it erroneously utilizes an Annualized Rate of Occurrence (ARO) of 0.05 (once every 20 years) instead of the correct ARO of 0.10. While it correctly identifies the Single Loss Expectancy (SLE) as $100,000, applying the wrong frequency metric halves the actual annualized loss expectancy, leading to an underestimation of the risk.
- ✗
$50,000
Why it's wrong here
This value is incorrect as it represents a mathematical error, potentially by applying an incorrect Exposure Factor of 10% or miscalculating the SLE. Alternatively, it represents the ALE if the threat occurred five times more frequently (ARO of 0.50) than the stated rate. It does not align with the standard quantitative risk assessment formula using the provided scenario metrics.
- ✗
$100,000
Why it's wrong here
This option represents the Single Loss Expectancy (SLE), which is the product of the Asset Value ($500,000) and the Exposure Factor (0.20). While calculating the SLE is a necessary intermediate step, this value is incorrect because it fails to incorporate the Annualized Rate of Occurrence (ARO) of 0.10 to determine the annualized financial impact.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Exposure factor
Exposure factor is the percentage of an asset's value that would be lost if a specific threat event occurs, used to calculate the single loss expectancy in risk analysis.
Key term
Risk
Risk is the possibility that an event or action will negatively affect an organization's ability to achieve its goals, often measured in terms of likelihood and impact.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.