PrepAway - Latest Free Exam Questions & Answers

Which type of risk assessment is the formula ALE = ARO …

Which type of risk assessment is the formula ALE = ARO x SLE used for?

PrepAway - Latest Free Exam Questions & Answers

A.
Quantitative Analysis

B.
Qualitative Analysis

C.
Objective Analysis

D.
Expected Loss Analysis

Explanation:
A quantitative risk analysis is used to assign monetary and numeric values to all elements of the risk analysis
process. Each element within the analysis (asset value, threat frequency, severity of vulnerability, impact
damage, safeguard costs, safeguard effectiveness, uncertainty, and probability items) is quantified and entered
into equations to determine total and residual risks.
The most commonly used equations used in quantitative risk analysis are the single loss expectancy (SLE) and
the annual loss expectancy (ALE).
The SLE is a dollar amount that is assigned to a single event that represents the company’s potential loss
amount if a specific threat were to take place.
The annualized rate of occurrence (ARO) is the value that represents the estimated frequency of a specific
threat taking place within a 12-month timeframe.
Incorrect Answers:
B: Qualitative risk analysis quantifies the risk rather than assigning a monetary value to the impact of a risk. It
does not use the ALE = ARO x SLE formula.
C: Objective Analysis is not one of the defined risk assessment methods and does not use the ALE = ARO x
SLE formula.
D: Expected Loss Analysis is not one of the defined risk assessment methods. Expected loss is calculated
using the quantitative risk analysis method.References:
Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 87


Leave a Reply