Which of the following is true for Single loss expectancy (SLE), Annual rate of occurrence (ARO), and Annual loss expectancy (ALE)?

• A.ALE= ARO/SLE
• B.ARO= SLE/ALE
• C.ARO= ALE*SLE
• D.ALE= ARO*SLE

Correct Answer: D

Explanation/Reference:
Explanation:
A quantitative risk assessment quantifies risk in terms of numbers such as dollar values. This involves gathering data and then entering it into standard formulas. The results can help in identifying the priority of risks. These results are also used to determine the effectiveness of controls. Some of the terms associated with quantitative risk assessments are:
Single loss expectancy (SLE)-It refers to the total loss expected from a single incident. This incident

can occur when vulnerability is being exploited by threat. The loss is expressed as a dollar value such as $1,000. It includes the value of data, software, and hardware. SLE = Asset value * Exposure factor Annual rate of occurrence (ARO)-It refers to the number of times expected for an incident to occur in a

year. If an incident occurred twice a month in the past year, the ARO is 24. Assuming nothing changes, it is likely that it will occur 24 times next year. Annual loss expectancy (ALE)-It is the expected loss for a year. ALE is calculated by multiplying SLE with ARO. Because SLE is a given in a dollar value, ALE is also given in a dollar value. For example, if the SLE is $1,000 and the ARO is 24, the ALE is $24,000.
ALE = SLE * ARO Safeguard value-This is the cost of a control. Controls are used to mitigate risk. For

example, antivirus software of an average cost of $50 for each computer. If there are 50 computers, the safeguard value is $2,500. A, B, C: These are wrong formulas and are not used in quantitative risk assessment.

Comment: *

Name: *

Email: *

Verification: *

Jenny is the project manager for the NBT projects. She is working with the project team and several subject matter experts to perform the quantitative risk analysis process. During this process she and the project team uncover several risks events that were not previously identified. What should Jenny do with these risk events?

• A.The events should be entered into qualitative risk analysis.
• B.The events should be determined if they need to be accepted or responded to.
• C.The events should be entered into the risk register.
• D.The events should continue on with quantitative risk analysis.

Correct Answer: C

Explanation/Reference:
Explanation:
All identified risk events should be entered into the risk register.
A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
A description of the risk

The impact should this event actually occur

The probability of its occurrence

Risk Score (the multiplication of Probability and Impact)

A summary of the planned response should the event occur

A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the

event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

Incorrect Answers:
A: Before the risk events are analyzed they should be documented in the risk register.
B: The risks should first be documented and analyzed.
D: These risks should first be identified, documented, passed through qualitative risk analysis and then it should be determined if they should pass through the quantitative risk analysis process.

Comment: *

Name: *

Email: *

Verification: *

An organization is planning to engage a cloud-based service provider for some of its data-intensive business processes. Which of the following is MOST important to help define the IT risk associated with this outsourcing activity?

• A.Service level agreement
• B.Right to audit the provider
• C.Customer service reviews
• D.Scope of services provided

Comment: *

Name: *

Email: *

Verification: *

Participants in a risk workshop have become focused on the financial cost to mitigate risk rather than choosing the most appropriate response. Which of the following is the BEST way to address this type of issue in the long term?

• A.Raise the maturity of organizational risk management.
• B.Calculate annualized loss expectancy of risk scenarios.
• C.Review the risk register and risk scenarios.
• D.Perform a return on investment analysis.

Comment: *

Name: *

Email: *

Verification: *

To reduce the risk introduced when conducting penetration tests, the BEST mitigating control would be to:

• A.perform background checks on the vendor.
• B.notify network administrators before testing
• C.require the vendor to sign a nondisclosure agreement
• D.clearly define the project scope.

Comment: *

Name: *

Email: *

Verification: *