Security Risk Assessment & Management Flashcards

A single loss event is estimated at $50,000 and is expected to occur once every five years. What is the annualized loss expectancy (ALE)?

Answer: $10,000

ARO is 0.2, so ALE = $50,000 × 0.2 = $10,000.

A warehouse holds assets valued at $400,000. A fire would be expected to destroy 25% of them. What is the single loss expectancy?

Answer: $100,000

SLE = asset value × exposure factor = $400,000 × 0.25.

Who is ultimately accountable for accepting residual risk in an organization?

Answer: Senior management or the designated risk owner

Risk acceptance is a business decision made by those with authority over the affected assets and budget.

Which technique is a qualitative risk analysis method?

Answer: Risk matrix scoring based on expert judgment

Qualitative methods rank risks using descriptive scales rather than monetary values.

A threat assessment primarily seeks to identify which of the following?

Answer: Adversaries and events capable of causing harm, with their intent and capability

Threat assessment characterizes who or what could cause harm; vulnerability assessment examines weaknesses.

A countermeasure costs $30,000 per year and reduces ALE from $80,000 to $40,000. What is the net annual benefit?

Answer: $10,000

Benefit = ($80,000 − $40,000) − $30,000 = $10,000.

Purchasing cyber or property insurance to cover potential losses is an example of which risk treatment?

Answer: Risk transfer

Insurance shifts the financial consequence of a loss to a third party.