ITPEC FE Morning April 2023 Question 41
An asset valued at $200,000 has an exposure factor of 20% and an annual rate of occurrence of 0.5 for the risk of malware infection. How much (in dollars) is the annual loss expectancy of the asset due to malware infection?
Explanation
$20,000 — the annual loss expectancy is the loss from one incident times the number of incidents expected per year.
- •Single loss expectancy (SLE) = asset value × exposure factor = 200,000 × 0.2 = $40,000
- •Annual loss expectancy (ALE) = SLE × annual rate of occurrence = 40,000 × 0.5 = $20,000
Answer (a)
Why not others:
- •(b) 40,000 — stops at the single loss expectancy and never applies the rate of 0.5 incidents per year
- •(c) 80,000 — divides the SLE by the rate, 40,000 ÷ 0.5, instead of multiplying
- •(d) 100,000 — multiplies the asset value by the rate, 200,000 × 0.5, ignoring that one incident destroys only 20% of the asset
Key rule: ALE = asset value × exposure factor × annual rate of occurrence; a rate below 1 means the incident is expected less than once a year, so the ALE is smaller than the SLE.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.