SSCP Risk Identification, Monitoring, and Analysis Practice Question
An organization's web application experienced a data breach due to a SQL injection vulnerability. During the risk analysis phase, the security team calculated the SLE as $25,000 and the ARO as 0.5. What is the ALE?
⚠ Common exam trap
Candidates often confuse multiplication with division or forget to apply the ARO, selecting the SLE value directly instead of computing the product.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
$12,500
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO). Given an SLE of $25,000 and an ARO of 0.5, the ALE is $25,000 × 0.5 = $12,500. This quantifies the expected annual financial loss from the SQL injection vulnerability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
$50,000
Why it's wrong here
$50,000 doubles the SLE rather than annualising it. ALE is SLE times ARO: $25,000 × 0.5 = $12,500. Multiplying by two would be right only if the annualised rate of occurrence were 2.0, meaning two breaches per year.
- ✗
$25,000
Why it's wrong here
ALE is SLE multiplied by ARO, giving $12,500 here. $25,000 is the SLE itself — the cost of a single breach occurrence — so this option simply restates a figure already supplied rather than performing the annualised calculation. SLE alone would be the answer only if the question asked for single-loss expectancy.
- ✗
$6,250
Why it's wrong here
$6,250 equals SLE divided by ARO, inverting the formula. ALE requires multiplying $25,000 by 0.5, yielding $12,500. Division would apply only if the stem gave ALE and ARO and asked for SLE, which is not the case here.
- ✓
$12,500
Why this is correct
ALE is derived by multiplying single loss expectancy by annualised rate of occurrence: $25,000 × 0.5 = $12,500. This satisfies the stem's requirement to quantify expected yearly loss from the SQL injection breach, giving the security team a monetary figure for risk prioritisation.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.