nerdexam
GIAC

GSLC · Question #497

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

The correct answer is C. Annualized Rate of Occurrence (ARO). ARO (Annualized Rate of Occurrence) is the quantitative risk metric that expresses how many times per year a specific threat is expected to materialize, and is a direct input to the ALE formula.

Risk Management & Compliance

Question

Which of the following terms related to risk management represents the estimated frequency at which a threat is expected to occur?

Options

  • ASingle Loss Expectancy (SLE)
  • BExposure Factor (EF)
  • CAnnualized Rate of Occurrence (ARO)
  • DSafeguard

How the community answered

(66 responses)
  • A
    6% (4)
  • B
    3% (2)
  • C
    89% (59)
  • D
    2% (1)

Why each option

ARO (Annualized Rate of Occurrence) is the quantitative risk metric that expresses how many times per year a specific threat is expected to materialize, and is a direct input to the ALE formula.

ASingle Loss Expectancy (SLE)

SLE (Single Loss Expectancy) is the estimated dollar value lost from a single occurrence of a threat, calculated as Asset Value x Exposure Factor, making it a monetary figure rather than a frequency measure.

BExposure Factor (EF)

Exposure Factor is a percentage representing the proportion of an asset's value destroyed in a single threat event, not a measure of how often the threat occurs.

CAnnualized Rate of Occurrence (ARO)Correct

ARO represents the estimated frequency - expressed as occurrences per year - at which a specific threat is expected to occur. It is a core variable in the ALE formula (ALE = SLE x ARO), where a value of 1.0 means once per year and 0.5 means once every two years. This makes it the metric that directly answers 'how often' a threat happens.

DSafeguard

A safeguard is a security control or countermeasure implemented to reduce risk exposure, not a metric used to quantify or estimate threat frequency.

Concept tested: Annualized Rate of Occurrence in quantitative risk analysis

Source: https://csrc.nist.gov/glossary/term/annualized_rate_of_occurrence

Topics

#ARO#risk quantification#threat frequency#risk metrics

Community Discussion

No community discussion yet for this question.

Full GSLC Practice