CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  $7,500

  Why this is correct

  This value correctly represents the Annualized Loss Expectancy (ALE), which is a key metric in quantitative risk analysis. It is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Assuming an SLE of $15,000 and an ARO of 0.5 (meaning the event is expected to occur once every two years), the ALE is $15,000 * 0.5 = $7,500. This figure quantifies the expected financial loss from a specific risk over a one-year period, informing cost-benefit analyses for security controls.

• ✗

  $30,000

  Why it's wrong here

  This value is incorrect for the Annualized Loss Expectancy (ALE) and indicates a miscalculation. It appears to be derived by multiplying the Single Loss Expectancy (SLE) of $15,000 by an incorrect Annualized Rate of Occurrence (ARO) of 2, or by simply doubling the SLE. Such an error would imply the threat event occurs twice a year, which contradicts the scenario where $7,500 is the correct ALE, suggesting an ARO of 0.5. This miscalculation significantly overestimates the annual financial impact of the risk, leading to potentially misguided resource allocation.

• ✗

  $15,000

  Why it's wrong here

  This figure represents the Single Loss Expectancy (SLE), which is the monetary loss expected each time a specific threat event occurs. SLE is calculated as the Asset Value (AV) multiplied by the Exposure Factor (EF), quantifying the impact of a single incident. However, the question asks for a value that is likely the Annualized Loss Expectancy (ALE), which incorporates the frequency of occurrence over a year. Therefore, while $15,000 is a crucial component in the ALE calculation, it is not the final annualized figure that accounts for recurrence.

• ✗

  $75,000

  Why it's wrong here

  This value is significantly higher than the correct Annualized Loss Expectancy (ALE) and strongly suggests a calculation error, most likely a misplaced decimal point or an incorrect multiplier. If the Single Loss Expectancy (SLE) is $15,000 and the Annualized Rate of Occurrence (ARO) is 0.5, then multiplying $15,000 by 5 instead of 0.5, or by 0.05 and then by 10, would lead to this erroneous result. Such a substantial overestimation would lead to misinformed risk management decisions, potentially causing an organization to overspend on controls for a less impactful risk.

Go deeper

Related to this question