Risk Analysis

1. A laptop valued at $2,000 is stolen from a company vehicle. The entire laptop and its contents are lost with no recovery. What is the Single Loss Expectancy (SLE) for this incident?

A. $1,000 — SLE is always half the asset value for theft scenarios B. $2,000 — SLE = AV × EF = $2,000 × 1.0 = $2,000, since the entire asset is lost (EF = 1.0) C. $4,000 — SLE doubles the asset value to account for replacement and lost productivity D. Cannot be determined without knowing the ARO

2. An organization loses an average of 5 laptops per year to theft. Each stolen laptop has an SLE of $1,500. What is the Annualized Loss Expectancy (ALE), and how does this figure inform the security budget decision?

A. ALE = $300; a security control costing more than $300 per year is not cost-justified B. ALE = $7,500 (ARO 5 × SLE $1,500); any security control costing less than $7,500 per year that prevents these thefts is cost-justified C. ALE = $1,500; ALE is the same as SLE when ARO is less than 10 D. ALE = $15,000 (SLE × 10 to account for indirect costs)

3. A risk assessment uses a traffic light grid with green, yellow, and red cells to display risk factors like legacy systems, untrained staff, and missing antivirus across dimensions of impact, likelihood, and control cost. What type of risk assessment is this?

A. Quantitative — the grid assigns numerical values to each risk dimension B. Qualitative — uses descriptive color-coded categories (low/medium/high) rather than precise numerical calculations; displays risk in broad terms for management visibility C. Both qualitative and quantitative — traffic light grids combine color and numerical scoring D. Neither — traffic light grids are a compliance tool, not a risk assessment method

4. A server worth $50,000 is partially damaged in a fire. Forensic engineers determine that 40% of the server's value was destroyed. What is the Exposure Factor (EF) and the Single Loss Expectancy (SLE) for this incident?

A. EF = 0.60, SLE = $30,000 (the remaining value) B. EF = 0.40, SLE = $20,000 (AV $50,000 × EF 0.40 = $20,000 lost) C. EF = 1.0, SLE = $50,000 (any fire incident is treated as total loss) D. EF = 0.40, SLE = $50,000 (EF adjusts likelihood, not the loss amount)

5. An organization's board states that they have a "conservative" risk appetite. The CISO later explains that the company will accept a 5% variance above the stated appetite before escalating for board action. Which concept describes the 5% variance, and how does it differ from risk appetite?

A. Risk probability — the 5% is the quantitative likelihood of a risk being realized B. Risk tolerance — the acceptable variance above the stated risk appetite before action is required; appetite defines the policy limit while tolerance defines the practical enforcement threshold C. Risk likelihood — a qualitative measurement of how likely the board is to accept risk D. Risk threshold — the point at which mitigation costs equal mitigation benefits

6. A ransomware attack encrypts an entire hospital's patient scheduling and billing systems for 72 hours. The financial loss from lost billing is $200,000. Which impact category takes the highest priority during incident response, regardless of the financial figure?

A. Finance — the $200,000 figure is the highest quantifiable impact and receives highest priority B. Life — if patient scheduling systems are down, patients may not receive timely care; life safety is the highest-priority impact category regardless of financial figures C. Reputation — a hospital ransomware attack will generate media coverage that causes lasting damage D. Property — the encrypted systems represent property damage that must be addressed first

Matching: Quantitative Risk Terms

Match each term (1–4) to its correct definition (A–D).

1ARO (Annualized Rate of Occurrence)

2Exposure Factor (EF)

3SLE (Single Loss Expectancy)

4ALE (Annualized Loss Expectancy)

AThe percentage of an asset's value expected to be lost in a single incident; ranges from 0.0 (no loss) to 1.0 (total loss)

BThe expected annual financial impact of a recurring threat, calculated as the product of how often the incident occurs and how much each occurrence costs

CHow many times per year a specific threat event is expected to occur; used to convert single-incident cost into an annual financial figure

DThe monetary loss expected from a single occurrence of a specific threat against a specific asset; calculated as asset value multiplied by exposure factor

Risk Analysis — Quiz