CCP Quantitative Risk Assessment 2 — Questions and Answers
Question 1: An organization calculates that a server failure has a 15% chance of occurring each year and would cost $200,000 to recover. What is the Annual Loss Expectancy (ALE)?
- $15,000
- $30,000 (Correct answer)
- $200,000
- $133,333
Correct answer: $30,000
ALE = ARO × SLE = 0.15 × $200,000 = $30,000.
Question 2: Which metric represents the percentage of an asset's value that would be lost in a single security incident?
- Annual Rate of Occurrence (ARO)
- Exposure Factor (EF) (Correct answer)
- Return on Security Investment (ROSI)
- Mean Time Between Failures (MTBF)
Correct answer: Exposure Factor (EF)
Exposure Factor (EF) is the percentage of asset value lost per incident, used to calculate SLE.
Question 3: A risk analyst wants to determine the net benefit of implementing a $50,000 security control that reduces ALE from $120,000 to $40,000. What is the value of the control?
- $40,000
- $80,000
- $30,000 (Correct answer)
- $120,000
Correct answer: $30,000
Value = (ALE before - ALE after) - cost of control = ($120,000 - $40,000) - $50,000 = $30,000.
Question 4: In a Monte Carlo simulation for cyber risk, what does running thousands of iterations primarily help quantify?
- The exact cost of a single breach
- The probability distribution of potential losses (Correct answer)
- The number of vulnerabilities in a system
- The time required to patch systems
Correct answer: The probability distribution of potential losses
Monte Carlo simulations model uncertainty by running many iterations to produce a probability distribution of outcomes.
Question 5: An asset valued at $500,000 has an exposure factor of 40%. What is the Single Loss Expectancy (SLE)?
- $500,000
- $40,000
- $200,000 (Correct answer)
- $300,000
Correct answer: $200,000
SLE = Asset Value × EF = $500,000 × 0.40 = $200,000.
Question 6: What does a confidence interval of 95% mean in the context of a quantitative cyber risk assessment?
- 95% of systems are protected
- There is a 95% chance the actual loss will fall within the stated range (Correct answer)
- 95% of risks have been identified
- The model is 95% accurate
Correct answer: There is a 95% chance the actual loss will fall within the stated range
A 95% confidence interval means there is a 95% probability the true loss value lies within the calculated range.
Question 7: Which quantitative risk formula correctly expresses Return on Security Investment (ROSI)?
- ROSI = (ALE × Control Cost) / EF
- ROSI = (ALE Before - ALE After - Control Cost) / Control Cost (Correct answer)
- ROSI = Asset Value / ARO
- ROSI = SLE × ARO × EF
Correct answer: ROSI = (ALE Before - ALE After - Control Cost) / Control Cost
ROSI measures the net risk reduction relative to control cost: (ALE reduction - control cost) / control cost.
CCP Quantitative Risk Assessment 2
An organization calculates that a server failure has a 15% chance of occurring each year and would cost $200,000 to recover.
What is the Annual Loss Expectancy (ALE)?