nerdexam
CompTIA

CAS-002 · Question #752

A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company's online shopping application. Based on heuristic information from the Security…

The correct answer is A. $60,000. This question requires calculating net monetary value by comparing the reduction in Annual Loss Expectancy (ALE) against the cost of the countermeasure. The net savings after subtracting the countermeasure cost equals $60,000.

Research and Analysis

Question

A security analyst has been asked to develop a quantitative risk analysis and risk assessment for the company's online shopping application. Based on heuristic information from the Security Operations Center (SOC), a Denial of Service Attack (DoS) has been successfully executed 5 times a year. The Business Operations department has determined the loss associated to each attack is $40,000. After implementing application caching, the number of DoS attacks was reduced to one time a year. The cost of the countermeasures was $100,000. Which of the following is the monetary value earned during the first year of operation?

Options

  • A$60,000
  • B$100,000
  • C$140,000
  • D$200,000

How the community answered

(13 responses)
  • A
    69% (9)
  • B
    8% (1)
  • C
    15% (2)
  • D
    8% (1)

Why each option

This question requires calculating net monetary value by comparing the reduction in Annual Loss Expectancy (ALE) against the cost of the countermeasure. The net savings after subtracting the countermeasure cost equals $60,000.

A$60,000Correct

Original ALE = 5 occurrences x $40,000 = $200,000. New ALE after caching = 1 occurrence x $40,000 = $40,000. ALE reduction = $200,000 - $40,000 = $160,000. Subtracting the countermeasure cost of $100,000 yields a net monetary value of $60,000 in the first year of operation.

B$100,000

$100,000 represents only the cost of the countermeasure itself, not the net monetary value earned after accounting for loss reduction.

C$140,000

$140,000 does not correspond to any correct step in the ALE-based quantitative risk formula and conflates multiple values incorrectly.

D$200,000

$200,000 is the original ALE before any countermeasures were applied, not the value earned from implementing them.

Concept tested: Quantitative risk analysis - ALE, ARO, countermeasure value calculation

Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final

Topics

#quantitative risk analysis#ALE#ROI on controls#DoS mitigation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-002 Practice