SY0-701 Question 425
Single answerA healthcare company is evaluating the financial risk of a ransomware attack against its patient scheduling system. The asset value of the system is estimated at $500,000, and the security team estimates that a successful attack would disrupt operations long enough to cause 40% loss of value and recovery cost. Based on industry data and the company's incident history, the team estimates the likelihood of this event at 0.2 per year. During a budget meeting, the CIO asks which value best represents the annualized loss expectancy (ALE) for this specific risk so the company can compare the cost of a new backup and recovery solution against the expected yearly loss. Which of the following should the security analyst report?
- A
$40,000
- B
$100,000
- C
$200,000
- D
$250,000
Show answer and explanation
Correct answer: A
Explanation
This question tests quantitative risk analysis, which uses numerical estimates to calculate expected loss. The standard formulas are: SLE = Asset Value × Exposure Factor, and ALE = SLE × ARO. In this scenario, the asset value is $500,000, the exposure factor is 0.40, and the annualized rate of occurrence is 0.2. Therefore, SLE = $500,000 × 0.40 = $200,000, and ALE = $200,000 × 0.2 = $40,000. On Security+ and in practice, ALE is commonly used to justify control selection by comparing the expected annual loss to the annual cost of a safeguard. This aligns with established risk management practices described by sources such as NIST SP 800-30, which distinguishes qualitative and quantitative risk assessment methods and emphasizes likelihood and impact as core inputs to risk determination.
- A. Correct.
Correct. ALE is calculated as SLE × ARO. First calculate SLE: Asset Value ($500,000) × Exposure Factor (40%) = $200,000. Then calculate ALE: $200,000 × 0.2 = $40,000. This is the expected annual loss from this risk and is the key quantitative value used to compare the cost-effectiveness of safeguards.
- B. Incorrect.
Incorrect. $100,000 results from misapplying the formulas, such as multiplying the asset value by the ARO without correctly incorporating the exposure factor, or confusing partial loss with full asset loss. It does not represent the proper annualized loss expectancy for the scenario.
- C. Incorrect.
Incorrect. $200,000 is the single loss expectancy (SLE), not the annualized loss expectancy (ALE). It represents the expected loss from one successful ransomware incident, based on the 40% exposure factor applied to the $500,000 asset value.
- D. Incorrect.
Incorrect. $250,000 reflects a common misconception that a 50% loss is being assumed or that asset value is being divided incorrectly. The scenario explicitly states a 40% exposure factor and an ARO of 0.2, so this figure is unsupported.