Examkin

Question

Difficulty: HardRisk Identification, Assessment, and Response Strategies

A fintech enterprise is assessing security controls for an e-commerce API gateway with an Asset Value (AV) of $1,200,000\$1,200,000. Threat intelligence indicates an Annual Rate of Occurrence (ARO) of 0.250.25 for a major distributed denial-of-service (DDoS) attack. The Chief Risk Officer (CRO) sets a maximum acceptable Annual Loss Expectancy (ALE) threshold of $15,000\$15,000 for DDoS-related risks. Which of the following represents the maximum Exposure Factor (EFEF) that an implemented Web Application Firewall must achieve to keep residual risk within this threshold?

  1. 5%5\%Answer
  2. B
    1.25%1.25\%
  3. C
    12.5%12.5\%
  4. D
    20%20\%

Answer

The maximum Exposure Factor (EFEF) required to remain within the risk threshold is 5%5\%.
The correct response accurately applies the quantitative risk equation ALE=AV×EF×ARO\text{ALE} = \text{AV} \times \text{EF} \times \text{ARO}. Substituting $15,000=$1,200,000×EF×0.25\$15,000 = \$1,200,000 \times \text{EF} \times 0.25 gives $15,000=$300,000×EF\$15,000 = \$300,000 \times \text{EF}. Solving for EF\text{EF} yields 15,000300,000=0.05\frac{15,000}{300,000} = 0.05, which equals 5%5\%. Any Exposure Factor higher than 5%5\% would exceed the Chief Risk Officer's $15,000\$15,000 annual risk threshold.

Step-by-Step Solution

1
Identify known variables from the scenario
Asset Value (AV)=$1,200,000(\text{AV}) = \$1,200,000, Annual Rate of Occurrence (ARO)=0.25(\text{ARO}) = 0.25, and target Annual Loss Expectancy (ALE)≤$15,000(\text{ALE}) \le \$15,000.
Extracting all required quantitative inputs is necessary before setting up the equation.
2
Recall the fundamental quantitative risk assessment formula
ALE=SLE×ARO=(AV×EF)×ARO\text{ALE} = \text{SLE} \times \text{ARO} = (\text{AV} \times \text{EF}) \times \text{ARO}
The formula links total asset value, exposure percentage, and frequency of occurrence to total annual financial risk.
3
Algebraically isolate the target variable (EFEF)
EF=ALEAV×ARO\text{EF} = \frac{\text{ALE}}{\text{AV} \times \text{ARO}}
Rearranging the equation allows solving directly for the unknown exposure threshold.
4
Substitute values and perform the calculation
EF=15,0001,200,000×0.25=15,000300,000=0.05=5%\text{EF} = \frac{15,000}{1,200,000 \times 0.25} = \frac{15,000}{300,000} = 0.05 = 5\%
Computing the fraction yields the maximum allowable post-mitigation exposure factor.

Key Concept

Quantitative Risk Analysis (Solving for Exposure Factor given ALE, AV, and ARO)
Estimated Time:2m 0s
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic