Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

A cloud SaaS provider is evaluating a quantitative risk mitigation strategy for its primary customer invoicing repository, which has an Asset Value (AVAV) of $400,000\$400,000. Security assessment data indicates an unmitigated ransomware threat has an Exposure Factor (EFEF) of 25%25\% and an Annual Rate of Occurrence (AROARO) of 0.50.5. The organization is considering deploying an automated threat prevention platform costing $15,000\$15,000 per year, which is expected to reduce the EFEF to 5%5\% and the AROARO to 0.10.1. What is the net annual financial benefit of implementing this security control?

  1. $33,000\$33,000Answer
  2. B
    $48,000\$48,000
  3. C
    $35,000\$35,000
  4. D
    $15,000\$15,000

Answer

The net annual financial benefit of implementing the security safeguard is $33,000\$33,000.
The net annual benefit of a security safeguard is calculated as the initial Annual Loss Expectancy (ALEALE) minus the post-mitigation ALEALE, minus the annual cost of the safeguard. The initial ALEALE is $400,000×0.25×0.5=$50,000\$400,000 \times 0.25 \times 0.5 = \$50,000. The modified ALEALE is $400,000×0.05×0.1=$2,000\$400,000 \times 0.05 \times 0.1 = \$2,000. Subtracting the modified ALEALE ($2,000\$2,000) and the control cost ($15,000\$15,000) from the initial ALEALE ($50,000\$50,000) yields a net benefit of $33,000\$33,000.

Step-by-Step Solution

1
Calculate the initial (pre-mitigation) Annual Loss Expectancy (ALE)
Initial SLE=AV×EF=$400,000×0.25=$100,000SLE = AV \times EF = \$400,000 \times 0.25 = \$100,000. Initial ALE=SLE×ARO=$100,000×0.5=$50,000ALE = SLE \times ARO = \$100,000 \times 0.5 = \$50,000.
Determines the baseline expected financial loss per year without the safeguard.
2
Calculate the modified (post-mitigation) Annual Loss Expectancy (ALE)
Modified SLE=AV×EF=$400,000×0.05=$20,000SLE = AV \times EF = \$400,000 \times 0.05 = \$20,000. Modified ALE=SLE×ARO=$20,000×0.1=$2,000ALE = SLE \times ARO = \$20,000 \times 0.1 = \$2,000.
Determines the remaining expected annual loss after deploying the control.
3
Calculate the net annual financial benefit
Net Benefit = (Initial ALEALE - Modified ALEALE) - Annual Control Cost = ($50,000\$50,000 - $2,000\$2,000) - $15,000\$15,000 = $48,000\$48,000 - $15,000\$15,000 = $33,000\$33,000.
Subtracting both the remaining risk loss and the safeguard expense from the initial loss gives the true annual cost savings.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Estimated Time:1m 30s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic