SSCP Risk Identification, Monitoring, and Analysis Practice Question
A risk analyst is conducting a quantitative risk analysis for a data center. The analyst needs to calculate the annualized loss expectancy (ALE). Which TWO of the following values are required to compute ALE? (Choose two.)
⚠ Common exam trap
The trap here is including exposure factor or asset value as direct inputs to ALE, when they are actually components of SLE, which in turn feeds ALE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Single loss expectancy (SLE)
The annualized loss expectancy is computed by multiplying the single loss expectancy by the annualized rate of occurrence. SLE represents the expected loss from one incident, while ARO estimates how many times that incident will occur in a year. Together they yield the expected yearly financial impact of a risk. Exposure factor and asset value feed into SLE, but are not direct inputs to ALE. ROSI is a separate metric for evaluating controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Return on security investment (ROSI)
Why it's wrong here
ROSI is a metric used to evaluate the cost-effectiveness of security controls, not an input to ALE. It is calculated after determining ALE and the cost of controls. Including ROSI in the ALE formula would be circular and incorrect. The scenario asks for values needed to compute ALE, and ROSI is an output of risk management decisions, not a prerequisite.
- ✓
Single loss expectancy (SLE)
Why this is correct
ALE is calculated as SLE multiplied by the annualized rate of occurrence (ARO). Therefore, SLE is a required input. SLE represents the monetary loss from a single incident, including costs such as downtime, data recovery, and reputational damage. Without SLE, the analyst cannot determine the expected yearly loss from a given risk, making this a necessary component.
- ✓
Annualized rate of occurrence (ARO)
Why this is correct
ARO is the estimated number of times a threat will occur per year. It is the second essential factor in the ALE formula: ALE = SLE × ARO. Without ARO, the analyst cannot annualize the single loss. For example, if SLE is $10,000 and ARO is 0.5, the ALE is $5,000. Thus, ARO is required for quantitative risk analysis.
- ✗
Asset value (AV)
Why it's wrong here
Asset value is used to compute SLE (SLE = AV × EF). It is not a direct input to the ALE formula, which relies on SLE and ARO. While AV is critical for determining the potential loss, the ALE calculation does not require AV if SLE is already known. Therefore, it is not one of the two values directly required to compute ALE.
- ✗
Exposure factor (EF)
Why it's wrong here
Exposure factor is used to calculate SLE, not ALE directly. The formula for SLE is asset value (AV) multiplied by EF. While EF is important in the overall quantitative process, it is not a direct input to the ALE calculation once SLE is known. The question asks for values required to compute ALE, and EF is a component of SLE, not ALE itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.