312-50V11 · Question #751
The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a
The correct answer is D. $146. ALE is calculated as SLE multiplied by ARO; the total replacement and recovery cost of $440 divided annually over 3 years yields approximately $146 per year.
Question
The change of a hard drive failure is once every three years. The cost to buy a new hard drive is $300. It will require 10 hours to restore the OS and software to the new hard disk. It will require a further 4 hours to restore the database from the last backup to the new hard disk. The recovery person earns $10/hour. Calculate the SLE, ARO, and ALE. Assume the EF = 1(100%). What is the closest approximate cost of this replacement and recovery operation per year?
Options
- A$1320
- B$440
- C$100
- D$146
How the community answered
(26 responses)- A4% (1)
- B8% (2)
- C4% (1)
- D85% (22)
Why each option
ALE is calculated as SLE multiplied by ARO; the total replacement and recovery cost of $440 divided annually over 3 years yields approximately $146 per year.
$1,320 would result from incorrectly multiplying the SLE of $440 by 3, which inverts the ARO fraction and treats the event as occurring 3 times per year rather than once every 3 years.
$440 correctly represents the SLE - the full financial impact of a single incident - but it does not account for the ARO of 1/3 and therefore overstates the annualized cost.
$100 does not correspond to any correct application of the SLE, ARO, or ALE formulas using the asset value and labor figures provided in the scenario.
SLE equals the hard drive cost plus labor: $300 + (10 + 4 hours x $10/hour) = $300 + $140 = $440. ARO equals 1 occurrence per 3 years = 0.333. ALE = SLE x ARO = $440 x 0.333 = approximately $146.67, making $146 the closest answer. This standard risk quantification formula is fundamental to security risk assessments and business impact analysis.
Concept tested: Risk quantification using SLE ARO and ALE formulas
Source: https://csrc.nist.gov/glossary/term/annualized_loss_expectancy
Topics
Community Discussion
No community discussion yet for this question.