CSSLP · Question #49
An asset with a value of $600,000 is subject to a successful malicious attack threat twice a year. The asset has an exposure of 30 percent to the threat. What will be the annualized loss expectancy?
The correct answer is A. $360,000. The Annualized Loss Expectancy (ALE) is calculated by multiplying the Asset Value (AV) by the Exposure Factor (EF) to get the Single Loss Expectancy (SLE), and then multiplying SLE by the Annualized Rate of Occurrence (ARO).
Question
An asset with a value of $600,000 is subject to a successful malicious attack threat twice a year. The asset has an exposure of 30 percent to the threat. What will be the annualized loss expectancy?
Options
- A$360,000
- B$180,000
- C$280,000
- D$540,000
How the community answered
(17 responses)- A82% (14)
- B12% (2)
- D6% (1)
Why each option
The Annualized Loss Expectancy (ALE) is calculated by multiplying the Asset Value (AV) by the Exposure Factor (EF) to get the Single Loss Expectancy (SLE), and then multiplying SLE by the Annualized Rate of Occurrence (ARO).
First, calculate the Single Loss Expectancy (SLE) = Asset Value (AV) * Exposure Factor (EF). So, SLE = $600,000 * 0.30 = $180,000. Next, calculate the Annualized Loss Expectancy (ALE) = SLE * Annualized Rate of Occurrence (ARO). Here, ARO is 2 (twice a year). Therefore, ALE = $180,000 * 2 = $360,000.
This represents the Single Loss Expectancy (SLE) ($180,000 = $600,000 * 0.30), not the Annualized Loss Expectancy (ALE). It does not account for the two occurrences per year.
This calculation is incorrect; it does not follow the standard ALE formula.
This calculation ($600,000 * 0.30 * 3) assumes three occurrences, not two, and is an incorrect application of the formula.
Concept tested: Risk assessment- Annualized Loss Expectancy (ALE) calculation
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-30r1.pdf
Topics
Community Discussion
No community discussion yet for this question.