Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An enterprise cloud service provider assesses a critical customer database system with an estimated Asset Value (AVAV) of $1,200,000\$1,200,000. Quantitative risk analysis indicates that an unmitigated database security breach has an Annual Rate of Occurrence (AROARO) of 0.400.40 and results in an Annual Loss Expectancy (ALEALE) of $144,000\$144,000. What is the Exposure Factor (EFEF), expressed as a percentage, for this potential security incident?

Answer: 30 %

Answer

The Exposure Factor (EFEF) for this security incident is 30%30\%.
To calculate the Exposure Factor (EFEF), apply the core quantitative risk equations: ALE=SLE×AROALE = SLE \times ARO and SLE=AV×EFSLE = AV \times EF. Substituting the known variables into SLE=ALEAROSLE = \frac{ALE}{ARO} yields SLE=$144,0000.40=$360,000SLE = \frac{\$144,000}{0.40} = \$360,000. Next, substitute SLESLE into EF=SLEAVEF = \frac{SLE}{AV} to obtain EF=$360,000$1,200,000=0.30EF = \frac{\$360,000}{\$1,200,000} = 0.30, or 30%30\%.

Step-by-Step Solution

1
Calculate Single Loss Expectancy (SLE) from ALE and ARO.
SLE=$144,0000.40=$360,000SLE = \frac{\$144,000}{0.40} = \$360,000
The standard formula for Annual Loss Expectancy is ALE=SLE×AROALE = SLE \times ARO. Rearranging the equation to isolate SLESLE yields SLE=ALEAROSLE = \frac{ALE}{ARO}.
2
Calculate Exposure Factor (EF) using Asset Value (AV) and SLE.
EF=$360,000$1,200,000=0.30=30%EF = \frac{\$360,000}{\$1,200,000} = 0.30 = 30\%
Single Loss Expectancy is calculated as SLE=AV×EFSLE = AV \times EF. Rearranging to solve for EFEF gives EF=SLEAVEF = \frac{SLE}{AV}.

Key Concept

Quantitative Risk Assessment (Calculating Exposure Factor from ALE, ARO, and AV)
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic