nerdexam
CompTIA

SY0-501 · Question #225

A security analyst is performing a quantitative risk analysis. The risk analysis should show the potential monetary loss each time a threat or event occurs. Given this requirement, which of the…

The correct answer is B. AV D. EF. Quantitative risk analysis uses specific monetary formulas to calculate loss. The Single Loss Expectancy (SLE) represents the monetary loss per single threat occurrence, calculated as Asset Value (AV) multiplied by Exposure Factor (EF).

Submitted by devops_kid· Mar 4, 2026Security program management and oversight

Question

A security analyst is performing a quantitative risk analysis. The risk analysis should show the potential monetary loss each time a threat or event occurs. Given this requirement, which of the following concepts would assist the analyst in determining this value? (Select two.)

Options

  • AALE
  • BAV
  • CARO
  • DEF
  • EROI

How the community answered

(48 responses)
  • A
    2% (1)
  • B
    79% (38)
  • C
    13% (6)
  • E
    6% (3)

Why each option

Quantitative risk analysis uses specific monetary formulas to calculate loss. The Single Loss Expectancy (SLE) represents the monetary loss per single threat occurrence, calculated as Asset Value (AV) multiplied by Exposure Factor (EF).

AALE

ALE (Annualized Loss Expectancy) represents the expected yearly monetary loss (ALE = SLE × ARO), not the loss per single occurrence of a threat event.

BAVCorrect

Asset Value (AV) represents the monetary worth of the asset being protected, which is a required input for calculating Single Loss Expectancy (SLE = AV × EF), directly contributing to the potential monetary loss per event.

CARO

ARO (Annualized Rate of Occurrence) represents how often a threat is expected to occur per year, not the monetary loss associated with a single occurrence.

DEFCorrect

Exposure Factor (EF) is the percentage of asset value lost when a specific threat occurs; combined with AV, it produces the SLE, which is exactly the 'potential monetary loss each time a threat or event occurs' the analyst needs.

EROI

ROI (Return on Investment) measures the financial benefit gained from a security control investment relative to its cost, not the monetary loss from a specific threat event.

Concept tested: Quantitative risk analysis SLE calculation components

Source: https://csrc.nist.gov/glossary/term/single_loss_expectancy

Topics

#quantitative risk analysis#SLE#asset value#exposure factor

Community Discussion

No community discussion yet for this question.

Full SY0-501 Practice