GSLC · Question #497
Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?
The correct answer is C. Annualized Rate of Occurrence (ARO). ARO (Annualized Rate of Occurrence) is the quantitative risk metric that expresses how many times per year a specific threat is expected to materialize, and is a direct input to the ALE formula.
Question
Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?
Options
- ASingle Loss Expectancy (SLE)
- BExposure Factor (EF)
- CAnnualized Rate of Occurrence (ARO)
- DSafeguard
How the community answered
(66 responses)- A6% (4)
- B3% (2)
- C89% (59)
- D2% (1)
Why each option
ARO (Annualized Rate of Occurrence) is the quantitative risk metric that expresses how many times per year a specific threat is expected to materialize, and is a direct input to the ALE formula.
SLE (Single Loss Expectancy) is the estimated dollar value lost from a single occurrence of a threat, calculated as Asset Value x Exposure Factor, making it a monetary figure rather than a frequency measure.
Exposure Factor is a percentage representing the proportion of an asset's value destroyed in a single threat event, not a measure of how often the threat occurs.
ARO represents the estimated frequency - expressed as occurrences per year - at which a specific threat is expected to occur. It is a core variable in the ALE formula (ALE = SLE x ARO), where a value of 1.0 means once per year and 0.5 means once every two years. This makes it the metric that directly answers 'how often' a threat happens.
A safeguard is a security control or countermeasure implemented to reduce risk exposure, not a metric used to quantify or estimate threat frequency.
Concept tested: Annualized Rate of Occurrence in quantitative risk analysis
Source: https://csrc.nist.gov/glossary/term/annualized_rate_of_occurrence
Topics
Community Discussion
No community discussion yet for this question.