SSCP Risk Identification, Monitoring, and Analysis Practice Question
An organization calculates the SLE for a server as $5,000 and the ARO as 0.2. What is the ALE?
⚠ Common exam trap
The trap here is that candidates often multiply SLE by the reciprocal of ARO (e.g., 5 instead of 0.2) or confuse ARO with a percentage, leading to an inflated ALE like $25,000.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$1,000
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given SLE = $5,000 and ARO = 0.2, the ALE is $5,000 × 0.2 = $1,000. This is the expected annual financial loss from the server risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$5,000
Why it's wrong here
ALE requires multiplying SLE by ARO; $5,000 is the SLE alone, with the 0.2 annualised rate never applied. It is tempting because the SLE is the most prominent figure in the stem, and $5,000 would be the correct answer if the question instead asked for the single loss expectancy.
- ✗
$10,000
Why it's wrong here
ALE is SLE multiplied by ARO, giving $5,000 × 0.2 = $1,000, so $10,000 doubles the correct figure. It is tempting because it resembles a plausible round result, and $10,000 would be correct if the ARO were 2.0 rather than 0.2.
- ✗
$25,000
Why it's wrong here
ALE is SLE × ARO = $5,000 × 0.2 = $1,000; $25,000 divides SLE by ARO instead of multiplying. It is tempting because it uses both supplied numbers, and $25,000 would be correct if the question asked how many years the ARO implies between loss events.
- ✓
$1,000
Why this is correct
Multiplying the single loss expectancy of $5,000 by the annualised rate of occurrence of 0.2 yields an annualised loss expectancy of $1,000. This satisfies the stem's requirement to derive the expected yearly financial loss from the two supplied quantitative risk values.
Go deeper
Related to this question
About these practice questions
This SSCP question is part of Courseiva's 971-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.