Examkin

Question

Difficulty: MediumRisk Identification, Assessment, and Response Strategies

An organization is evaluating a security safeguard for a facility control system valued at 150,000.Threatmodelingindicatesamajorsecuritycompromiseoccursonceevery5years(150,000. Threat modeling indicates a major security compromise occurs once every 5 years ( ARO = 0.20 ),resultinginanExposureFactor(), resulting in an Exposure Factor ( EF )of40) of 40%. The organization plans to deploy an inline monitoring gateway with an annual operating cost of 7,000, which will reduce the post-control Exposure Factor to 5% while keeping the ARO unchanged. What is the net annual financial savings realized by implementing this security control?

  1. $3,500Answer
  2. B
    $10,500
  3. C
    $12,000
  4. D
    $5,000

Answer

The net annual financial savings realized by implementing the control is $3,500.
The correct answer is obtained by conducting a quantitative risk cost-benefit analysis. Baseline pre-control annual loss expectation is AV×EF×ARO=$150,000×0.40×0.20=$12,000AV \times EF \times ARO = \$150,000 \times 0.40 \times 0.20 = \$12,000. With the security safeguard deployed, post-control ALE becomes $150,000×0.05×0.20=$1,500\$150,000 \times 0.05 \times 0.20 = \$1,500. The reduction in annual expected risk loss is $12,000−$1,500=$10,500\$12,000 - \$1,500 = \$10,500. Subtracting the annual safeguard maintenance cost of $7,000\$7,000 yields a net annual financial savings of $3,500\$3,500.

Step-by-Step Solution

1
Calculate pre-control Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Pre-control SLE = 150,000∗0.40=150,000 * 0.40 = 60,000. Pre-control ALE = 60,000∗0.20=60,000 * 0.20 = 12,000.
Determining baseline expected annual loss prior to safeguard installation is required for cost-benefit evaluation.
2
Calculate post-control Single Loss Expectancy (SLE) and Annual Loss Expectancy (ALE)
Post-control SLE = 150,000∗0.05=150,000 * 0.05 = 7,500. Post-control ALE = 7,500∗0.20=7,500 * 0.20 = 1,500.
Quantifying residual risk after control implementation identifies the remaining expected annual loss.
3
Determine gross ALE reduction and subtract annual safeguard cost for net savings
Gross ALE Reduction = 12,000−12,000 - 1,500 = 10,500.NetAnnualSavings=10,500. Net Annual Savings = 10,500 - 7,000=7,000 = 3,500.
Net savings measures the true financial benefit of implementing the safeguard after offsetting its operational cost.

Key Concept

Quantitative Risk Assessment and Safeguard Cost-Benefit Analysis
Rate this question

Topics

Risk Identification, Assessment, and Response Strategies

More questions from this topic