Calculate SLE and ALE: Formulas and Example
An organization is calculating the Annualized Loss Expectancy (ALE) for a server. The Asset Value (AV) is $50,000, the Exposure Factor (EF) is 40%, and the Annualized Rate of Occurrence (ARO) is 0.5. What is the Single Loss Expectancy (SLE) and ALE?
Quick Answer
SLE comes out to $20,000 and ALE to $10,000 because these figures are built from the same two-step formula every time: Single Loss Expectancy is Asset Value multiplied by Exposure Factor, and Annualized Loss Expectancy is that SLE multiplied by the Annualized Rate of Occurrence. Here, the asset is valued at $50,000, and the Exposure Factor of 40% represents the percentage of that asset's value expected to be lost in a single incident; multiplying the two gives SLE = $50,000 times 0.40 = $20,000, meaning one occurrence of this risk is expected to cost the organization $20,000. From there, the Annualized Rate of Occurrence of 0.5 represents how often the event is expected per year, in this case less than once a year, roughly once every two years, and multiplying SLE by that frequency gives ALE = $20,000 times 0.5 = $10,000, the expected average annual cost of this risk once frequency is factored in. Understanding why ALE is smaller than SLE in this case is instructive: whenever the ARO is below 1, meaning the event isn't expected to happen every single year, the annualized figure will be smaller than the cost of any single occurrence, because the loss is being spread out across more than one year on average. This SLE-then-ALE sequence is the standard path through quantitative risk calculations, and any question giving you Asset Value, Exposure Factor, and ARO is testing whether you can chain the two multiplications together in the right order.
⚠ Common exam trap
The trap here is that candidates may forget to apply the EF to the AV when calculating SLE, or they may invert the ARO (e.g., using 2 instead of 0.5) when computing ALE.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SLE = $20,000, ALE = $10,000
The Single Loss Expectancy (SLE) is calculated as Asset Value (AV) × Exposure Factor (EF) = $50,000 × 0.40 = $20,000. The Annualized Loss Expectancy (ALE) is then SLE × Annualized Rate of Occurrence (ARO) = $20,000 × 0.5 = $10,000. This matches option A exactly.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SLE = $20,000, ALE = $10,000
Why this is correct
SLE equals AV multiplied by EF: $50,000 × 0.40 = $20,000. ALE equals SLE multiplied by ARO: $20,000 × 0.5 = $10,000. These figures satisfy the stem's quantitative risk calculation, correctly applying the standard formulas to the given asset value, exposure factor and annualised rate of occurrence.
- ✗
SLE = $50,000, ALE = $25,000
Why it's wrong here
This treats SLE as the full asset value, ignoring the 40% exposure factor entirely, so the ALE is also overstated. It is tempting because ARO of 0.5 correctly halves the figure, making the arithmetic pattern appear sound while the EF is omitted.
- ✗
SLE = $10,000, ALE = $5,000
Why it's wrong here
SLE is AV multiplied by EF, giving $20,000, not $10,000; the $10,000 figure appears to halve the asset value instead of applying the 40% exposure factor. It is tempting because $5,000 is the correct ALE, so half the answer looks right.
- ✗
SLE = $20,000, ALE = $40,000
Why it's wrong here
SLE of $20,000 is correct, but ALE must multiply SLE by ARO (0.5), giving $10,000, not $40,000. It is tempting because it pairs the right SLE with a plausible-looking ALE, and doubling rather than halving is an easy slip.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on SSCP
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?
medium- A.$50,000
- B.$25,000
- C.$6,250
- ✓ D.$12,500
Why D: The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $25,000 and an ARO of 0.5, the ALE is $25,000 × 0.5 = $12,500. This quantifies the expected annual financial loss from the SQL injection vulnerability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.