CISSP Security and Risk Management Practice Question
A security team is performing a quantitative risk analysis for a server valued at $100,000. The exposure factor is 0.4 and the annual rate of occurrence is 2. What is the annualized loss expectancy (ALE)?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$80,000
SLE = AV × EF = $100,000 × 0.4 = $40,000. ALE = SLE × ARO = $40,000 × 2 = $80,000.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$40,000
Why it's wrong here
This value represents the Single Loss Expectancy (SLE), which is calculated by multiplying the Asset Value ($100,000) by the Exposure Factor (0.4). The SLE quantifies the monetary loss expected from a single occurrence of a specific threat. However, it does not account for the frequency of such occurrences over a year, making it an incomplete measure for the total annualized risk.
- ✗
$200,000
Why it's wrong here
This figure results from an incorrect calculation that multiplies the Asset Value ($100,000) directly by the Annualized Rate of Occurrence (2). This approach erroneously assumes a 100% loss (Exposure Factor of 1.0) for each incident, which contradicts the specified Exposure Factor of 0.4. Consequently, it significantly overestimates the actual financial impact per event and the overall annualized loss.
- ✗
$160,000
Why it's wrong here
This outcome would arise if the correct Single Loss Expectancy ($40,000) was then multiplied by an incorrect Annualized Rate of Occurrence (ARO) of 4, instead of the specified ARO of 2. While the initial calculation of SLE is accurate, using an inflated frequency for the threat's occurrence leads to a substantially higher and inaccurate Annualized Loss Expectancy. This demonstrates a misapplication of the ARO component in the overall risk calculation.
- ✓
$80,000
Why this is correct
This is the correct Annualized Loss Expectancy (ALE), derived from accurately applying the quantitative risk analysis formula. First, the Single Loss Expectancy (SLE) is calculated as the Asset Value ($100,000) multiplied by the Exposure Factor (0.4), yielding $40,000. This SLE is then correctly multiplied by the Annualized Rate of Occurrence (2) to determine the total expected financial loss over a year, which is $80,000.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
ARO
ARO stands for Annualized Rate of Occurrence, a number that estimates how often a specific threat or risk event is expected to happen in a single year.
Key term
Quantitative risk analysis
Quantitative risk analysis is a structured process that uses numerical data and statistical methods to calculate the potential financial impact of risks on an organization's assets and projects.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.