The exposure factor of a threat to your organization is defined by?

Question

Options

• AAsset value times exposure factor
• BAnnual rate of occurrence
• CAnnual loss expectancy minus current cost of controls
• DPercentage of loss experienced due to a realized threat event

• A
  13% (2)
• B
  6% (1)
• C
  6% (1)
• D
  75% (12)

Explanation

D is correct because the Exposure Factor (EF) specifically quantifies how much of an asset is lost when a threat is realized - expressed as a percentage between 0% and 100%. For example, if a fire destroys half a building worth $1M, the EF is 50%.

Why the distractors are wrong:

• A (Asset Value × EF) describes Single Loss Expectancy (SLE), not EF itself - it's the formula that uses EF to calculate a dollar loss.
• B (Annual Rate of Occurrence) is ARO, a separate variable representing how often a threat is expected to happen per year.
• C (ALE minus cost of controls) describes the Return on Security Investment (ROSI) calculation, used to justify security spending - not a definition of EF.

Memory tip: Think of EF as the "damage percentage" - it answers "what fraction of this asset gets wiped out?" The full risk formula chain is: EF → SLE (EF × Asset Value) → ALE (SLE × ARO). If you memorize that chain in order, the distinct role of each term becomes clear and the distractors won't trick you.

No community discussion yet for this question.