CISSP Security and Risk Management Practice Question
A security analyst is evaluating the risk of a data breach. The asset value of the database is $100,000, and the exposure factor is 0.5. If the annual rate of occurrence is 0.2, what is the annualized loss expectancy (ALE)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$10,000
SLE = AV * EF = $100,000 * 0.5 = $50,000. ALE = SLE * ARO = $50,000 * 0.2 = $10,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
$10,000
Why this is correct
This value represents the Annualized Loss Expectancy (ALE), which is derived by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $50,000 and an ARO of 0.2 (meaning a 20% chance of the event occurring annually), the correct ALE calculation is $50,000 * 0.2, resulting in $10,000. This figure quantifies the expected financial loss from a specific risk over a one-year period.
- ✗
$100,000
Why it's wrong here
This figure represents the Asset Value (AV), which is the total worth of the asset being protected, such as the data itself or the system housing it. While a critical component in risk assessment, the AV alone does not account for the probability or impact of a specific threat event. It is merely the starting point for calculating potential losses, not the Annualized Loss Expectancy (ALE).
- ✗
$50,000
Why it's wrong here
This amount represents the Single Loss Expectancy (SLE), which quantifies the financial impact of a single occurrence of a specific threat. The SLE is calculated by multiplying the Asset Value (AV) by the Exposure Factor (EF), representing the percentage of asset loss due to the threat. However, SLE does not incorporate the frequency of the event, making it an incomplete measure for the Annualized Loss Expectancy (ALE).
- ✗
$20,000
Why it's wrong here
This value would be obtained if an incorrect Annualized Rate of Occurrence (ARO) of 0.4 (or 40%) was used in the calculation. If the Single Loss Expectancy (SLE) is $50,000, multiplying it by an ARO of 0.4 yields $20,000. However, for this specific scenario, the correct ARO is 0.2, indicating a lower annual probability of the data breach occurring than assumed in this incorrect calculation.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
SLE
SLE (Single Loss Expectancy) is the monetary loss expected each time a specific risk event occurs, calculated as asset value times exposure factor.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.