A security analyst has determined that a security breach would have a financial impact of $15,000 and is expected to occur twice within a three-year period. Which of the following is the ALE for…

The correct answer is B. $10,000. ALE (Annual Loss Expectancy) = SLE × ARO, where SLE is the Single Loss Expectancy ($15,000) and ARO is the Annualized Rate of Occurrence. Since the breach occurs twice over three years, the ARO = 2/3 ≈ 0.667 - giving ALE = $15,000 × (2/3) = $10,000, making B correct. A ($7,500)…

Submitted by satoshi_tk· Mar 6, 2026Security program management and oversight

Question

A security analyst has determined that a security breach would have a financial impact of $15,000 and is expected to occur twice within a three-year period. Which of the following is the ALE for this risk?

Options

A$7,500
B$10,000
C$15,000
D$30,000

How the community answered

(51 responses)

A
2% (1)
B
76% (39)
C
14% (7)
D
8% (4)

Explanation

ALE (Annual Loss Expectancy) = SLE × ARO, where SLE is the Single Loss Expectancy ($15,000) and ARO is the Annualized Rate of Occurrence. Since the breach occurs twice over three years, the ARO = 2/3 ≈ 0.667 - giving ALE = $15,000 × (2/3) = $10,000, making B correct.

A ($7,500) is wrong - it has no basis in the standard formula; it would imply an ARO of 0.5 (once every two years), which doesn't match the scenario.
C ($15,000) is wrong - this is the SLE itself, which would only equal the ALE if the event occurred exactly once per year (ARO = 1).
D ($30,000) is the trap answer - it's the total loss over three years ($15,000 × 2), but ALE must be annualized, not totaled.

Memory tip: The word "Annual" in ALE is the key - always convert the occurrence frequency into a per-year rate before multiplying. "Twice in three years" ÷ 3 = 2/3 per year, not 2.

Topics

#Risk management#Annualized Loss Expectancy (ALE)#Quantitative risk analysis

Community Discussion

No community discussion yet for this question.

Full SY0-701 Practice