CompTIA SecurityX (CAS-005)Governance, Risk and ComplianceMedium
A security architect is performing a risk assessment for a new critical system. The architect identifies a vulnerability that, if exploited, could lead to a complete system outage. The cost of a single outage is estimated at $1,000,000. However, the probability of this specific vulnerability being exploited is very low, estimated at once every 10 years. What is the Annualized Loss Expectancy (ALE) for this specific risk?
- A$10,000
- B$10,000,000
- C$1,000,000
- D$100,000
Show answer & explanationAnswer & explanation
Correct answer: D. $100,000
Annualized Loss Expectancy (ALE) is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). The SLE is $1,000,000. The ARO is 1 (occurrence) divided by 10 (years), which is 0.1. Therefore, ALE = $1,000,000 * 0.1 = $100,000.
Why the other options are wrong
- A. $10,000 is an incorrect calculation.
- B. $10,000,000 would be if the ARO was 10, not 0.1.
- C. $1,000,000 is the Single Loss Expectancy (SLE).
Annualized Loss Expectancy (ALE)
The expected monetary loss from a risk event over a one-year period.
- Calculated as Single Loss Expectancy (SLE) * Annualized Rate of Occurrence (ARO).
- Used in quantitative risk analysis to prioritize risks.
- Provides a financial basis for cybersecurity investment decisions.
Memory trick: ALE is the yearly cost of a single hit repeating.