CAS-002 · Question #755
Which of the following provides the BEST risk calculation methodology?
The correct answer is B. Potential Loss x Event Probability x Control Failure Probability. The best risk calculation formula accounts for the magnitude of potential loss, the probability of a threat event occurring, and the probability that existing controls will fail to prevent it.
Question
Which of the following provides the BEST risk calculation methodology?
Options
- AAnnual Loss Expectancy (ALE) x Value of Asset
- BPotential Loss x Event Probability x Control Failure Probability
- CImpact x Threat x Vulnerability
- DRisk Likelihood x Annual Loss Expectancy (ALE)
How the community answered
(26 responses)- A4% (1)
- B77% (20)
- C12% (3)
- D8% (2)
Why each option
The best risk calculation formula accounts for the magnitude of potential loss, the probability of a threat event occurring, and the probability that existing controls will fail to prevent it.
ALE already embeds asset value through Single Loss Expectancy (SLE = Asset Value x Exposure Factor), so multiplying ALE by asset value again double-counts that component.
Multiplying Potential Loss by Event Probability and Control Failure Probability produces a comprehensive quantitative risk score. Unlike other formulas, it explicitly incorporates control effectiveness as a separate factor, ensuring the calculation reflects real-world residual risk rather than assuming controls always succeed.
Impact x Threat x Vulnerability is a simplified qualitative risk model used for rough prioritization, not a rigorous quantitative risk calculation methodology.
ALE is calculated as SLE x ARO (Annual Rate of Occurrence), meaning likelihood is already baked into ALE, making this multiplication circular and mathematically redundant.
Concept tested: Quantitative risk calculation formula components
Source: https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final
Topics
Community Discussion
No community discussion yet for this question.