Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An enterprise risk assessment identifies that an internal enterprise resource planning (ERP) database has an Asset Value (AVAV) of $600,000\$600,000. Historical security data indicates an Annual Rate of Occurrence (AROARO) of 0.20.2 for unauthorized data extraction threats targeting this database. The overall calculated Annual Loss Expectancy (ALEALE) for this vulnerability is $48,000\$48,000. Which of the following represents the Exposure Factor (EFEF) for this asset under the given threat scenario?

  1. 40%Answer
  2. B
    8%
  3. C
    16%
  4. D
    25%

Answer

40%
The Exposure Factor (EFEF) measures the percentage of asset value lost in a single threat event. Using quantitative risk relationships, Single Loss Expectancy (SLESLE) is computed as SLE=ALEARO=$48,0000.2=$240,000SLE = \frac{ALE}{ARO} = \frac{\$48,000}{0.2} = \$240,000. Substituting SLESLE into EF=SLEAVEF = \frac{SLE}{AV} gives $240,000$600,000=0.40\frac{\$240,000}{\$600,000} = 0.40, or 40%40\%.

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE) from Annual Loss Expectancy (ALE) and Annual Rate of Occurrence (ARO).
SLE=ALEARO=$48,0000.2=$240,000SLE = \frac{ALE}{ARO} = \frac{\$48,000}{0.2} = \$240,000
The quantitative risk formula establishes that ALE=SLE×AROALE = SLE \times ARO.
2
Calculate Exposure Factor (EF) from Single Loss Expectancy (SLE) and Asset Value (AV).
EF=SLEAV=$240,000$600,000=0.40EF = \frac{SLE}{AV} = \frac{\$240,000}{\$600,000} = 0.40 or 40%40\%
Single Loss Expectancy is defined as SLE=AV×EFSLE = AV \times EF.

Key Concept

Quantitative Risk Assessment Variables and Formulas (ALE=SLE×AROALE = SLE \times ARO and SLE=AV×EFSLE = AV \times EF)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic