SY0-701 Question 426
Single answerA healthcare company is evaluating the financial risk of ransomware affecting a file server that stores appointment and billing data. The server's asset value is estimated at $200,000. Based on previous incidents in similar organizations, the security analyst estimates that a successful ransomware event would disrupt operations and recovery efforts enough to cause a 40% loss of the asset's value. Industry data and internal threat intelligence suggest this type of event is likely to occur once every 5 years. Senior management asks for the annualized loss expectancy (ALE) for this risk so they can compare it to the annual cost of a new endpoint detection and response solution. What is the ALE?
- A
$16,000
- B
$40,000
- C
$80,000
- D
$100,000
Show answer and explanation
Correct answer: See explanation
Explanation
This question tests practical application of quantitative risk analysis, which Security+ expects candidates to understand at a working level. The standard formulas are: SLE = Asset Value × Exposure Factor, and ALE = SLE × Annualized Rate of Occurrence. In this scenario, the asset value is $200,000, the exposure factor is 40%, and the likelihood is once every 5 years, so the ARO is 0.2. Therefore, SLE = $80,000 and ALE = $16,000. This annualized figure helps management compare the expected yearly loss to the yearly cost of a safeguard, which is a common real-world use of quantitative risk analysis. By contrast, qualitative risk analysis would use relative ratings such as low, medium, or high rather than dollar amounts. These concepts align with common industry risk-management practices described in sources such as NIST SP 800-30, Guide for Conducting Risk Assessments, which distinguishes likelihood and impact as key components of risk assessment.
- A. Incorrect.
Correct. In quantitative risk analysis, Single Loss Expectancy (SLE) = Asset Value (AV) × Exposure Factor (EF). Here, SLE = $200,000 × 0.40 = $80,000. Annualized Rate of Occurrence (ARO) is once every 5 years, which is 0.2 per year. Annualized Loss Expectancy (ALE) = SLE × ARO = $80,000 × 0.2 = $16,000. This is the estimated annual financial impact of the ransomware risk.
- B. Incorrect.
Incorrect. $40,000 is what you would get by incorrectly multiplying the asset value by the ARO alone ($200,000 × 0.2), ignoring the exposure factor. This reflects a common mistake in quantitative risk analysis: skipping the SLE calculation and failing to account for the percentage of loss per incident.
- C. Incorrect.
Incorrect. $80,000 is the Single Loss Expectancy (SLE), not the ALE. It represents the expected loss from one successful ransomware incident based on a 40% exposure factor. A candidate might choose this if they confuse one-time impact with annualized impact.
- D. Incorrect.
Incorrect. $100,000 does not match the correct quantitative risk formulas for this scenario. A test taker might arrive at this value by confusing probability with impact or by incorrectly estimating the exposure factor as 50% instead of the stated 40%.