SSCP Risk Identification, Monitoring, and Analysis Practice Question
An organization wants to quantify the potential financial loss from a specific risk scenario. The risk team estimates that a data breach would cost $500,000 in direct expenses and that such an event is expected to occur once every five years. Which metric are they calculating?
⚠ Common exam trap
The trap here is selecting single loss expectancy because it matches the dollar figure in the scenario, but the question asks for the metric that incorporates the frequency of occurrence.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Annualized loss expectancy (ALE)
The team is calculating annualized loss expectancy by multiplying the single loss expectancy by the annualized rate of occurrence. With an SLE of $500,000 and an ARO of 0.2 (once every five years), the ALE is $100,000. This quantifies the expected yearly financial impact and helps prioritize risk mitigation investments.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Single loss expectancy (SLE)
Why it's wrong here
SLE is the monetary loss from a single occurrence of a risk, which in this scenario is $500,000. The question asks for the metric that combines this with the frequency of occurrence, so SLE alone does not incorporate the once-every-five-years estimate. The calculation performed yields a yearly expected loss, not a per-incident loss.
- ✓
Annualized loss expectancy (ALE)
Why this is correct
ALE is calculated by multiplying the single loss expectancy (SLE) by the annualized rate of occurrence (ARO). Here, SLE is $500,000 and ARO is 1/5 = 0.2, so ALE = $500,000 × 0.2 = $100,000. This metric expresses the expected yearly financial loss from the risk.
- ✗
Annualized rate of occurrence (ARO)
Why it's wrong here
ARO is the estimated frequency of an event per year, which here is 0.2 (once every five years). The scenario already provides this value as an input; the question asks for the resulting metric that combines ARO with the financial loss. ARO by itself does not express monetary impact.
- ✗
Exposure factor (EF)
Why it's wrong here
Exposure factor is the percentage of an asset's value lost in a single incident, used to calculate SLE. The scenario gives a direct dollar loss, not a percentage, and asks for a combined annualized financial metric. EF is a component of SLE, not the final expected yearly loss figure.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.