A security administrator is tasked with calculating the total ALE on servers. In a two-year period of time, a
company has to replace five servers. Each server replacement has cost the company $4,000 with downtime
costing $3,000. Which of the following is the ALE for the company?

Which of the following tasks should key elements of a business impact analysis include?

An advantage of virtualizing servers, databases, and office applications is:

Sara, a security analyst, is trying to prove to management what costs they could incur if their customer
database was breached. This database contains 250 records with PII. Studies show that the cost per record for
a breach is $300. The likelihood that their database would be breached in the next year is only 5%. Which of
the following is the ALE that Sara should report to management for a security breach?

Joe, the system administrator, has been asked to calculate the Annual Loss Expectancy (ALE) for a $5,000server, which often crashes. In the past year, the server has crashed 10 times, requiring a system reboot to
recover with only 10% loss of data or function. Which of the following is the ALE of this server?

Which of the following preventative controls would be appropriate for responding to a directive to reduce the
attack surface of a specific host?

A system administrator has concerns regarding their users accessing systems and secured areas using others’
credentials. Which of the following can BEST address this concern?

After running into the data center with a vehicle, attackers were able to enter through the hole in the building
and steal several key servers in the ensuing chaos. Which of the following security measures can be put in
place to mitigate the issue from occurring in the future?

A security administrator wants to deploy a physical security control to limit an individual’s access into a sensitive
area. Which of the following should be implemented?

Due to issues with building keys being duplicated and distributed, a security administrator wishes to change to a
different security control regarding a restricted area. The goal is to provide access based upon facial
recognition. Which of the following will address this requirement?