All practice questions

A hospital network evaluates the financial exposure associated with a potential ransomware incident targeting its central Picture Archiving and Communication System (PACS) database server cluster. The estimated Asset Value ($AV$) of the PACS cluster is $\$800,000$. Threat intelligence and risk assessment analysts determine that a ransomware outbreak would result in an Exposure Factor ($EF$) of $0.35$ ($35\%$). Historical risk data indicates an Annualized Rate of Occurrence ($ARO$) of $0.25$ for this type of attack. What is the baseline Annualized Loss Expectancy ($ALE$), in US dollars, for the PACS database cluster prior to implementing any additional security controls?

A manufacturing enterprise is conducting a quantitative risk analysis on a critical industrial control system (ICS) server. The server has an estimated Asset Value ($AV$) of $\$120,000$. A specific malware outbreak is projected to result in an Exposure Factor ($EF$) of $40\%$. Historical threat intelligence indicates that the Annualized Rate of Occurrence ($ARO$) for this type of attack is $0.5$. What is the baseline Annualized Loss Expectancy ($ALE$) in dollars for this asset prior to implementing additional countermeasures?

An IT risk manager evaluates a critical file storage server with an estimated asset value of $90,000. A recent threat assessment determines that a localized ransomware infection would result in an Exposure Factor (EF) of 30%. What is the Single Loss Expectancy (SLE) for this server in dollars?

An organization is evaluating the annual financial exposure of a cloud storage infrastructure valued at $800,000. A recent risk assessment reveals that ransomware attacks pose a threat to this system with an estimated Exposure Factor (EF) of 0.25 (25%). Threat intelligence indicates that the Annualized Rate of Occurrence (ARO) for this type of attack vector is 0.50 (once every two years). Based on quantitative risk analysis methodology, what is the calculated Annualized Loss Expectancy (ALE) in US dollars?

A financial technology firm evaluates the potential impact of a ransomware incident on a database server valued at $250,000. Security analysts determine that a successful attack would result in an Exposure Factor ($ EF $) of$ 20\%$($ 0.20 $). What is the Single Loss Expectancy ($ SLE$) in dollars for this asset?

An e-commerce enterprise hosts a customer transaction database valued at $500,000. Security metrics indicate that a successful SQL injection attack has an Exposure Factor (EF) of 0.15, and threat intelligence data estimates the Annualized Rate of Occurrence (ARO) for this threat vector to be 0.40. What is the Annualized Loss Expectancy (ALE) in dollars for this database asset?

An organization relies on an Operational Technology (OT) supervisory control and data acquisition (SCADA) system valued at $\$2,500,000$. Historical threat assessments indicate that an unmitigated industrial ransomware attack has an Exposure Factor (EF) of $60\%$ ($0.60$) and an Annualized Rate of Occurrence (ARO) of $0.20$ ($1$ event every $5$ years).

To mitigate this risk, the security team proposes deploying an immutable network air-gap and anomaly monitoring safeguard with an annual operating cost of $\$65,000$. With this safeguard active, the EF is reduced to $10\%$ ($0.10$) and the ARO is reduced to $0.05$ ($1$ event every $20$ years).

What is the net annual cost savings (in USD) achieved by implementing this safeguard?

A healthcare organization is conducting a quantitative risk assessment on an unencrypted portable diagnostic platform. The total asset value ($AV$), including sensitive data asset valuation and regulatory non-compliance exposure, is estimated at $\$600,000$. Security metrics indicate that a single breach incident would impact $30\%$ of the asset's total value ($EF = 0.30$). Historical threat intelligence indicates that this specific type of breach occurs once every $4$ years ($ARO = 0.25$).

What is the Annual Loss Expectancy ($ALE$) in dollars associated with this security risk?

A logistics organization is performing a quantitative risk assessment for its automated warehouse management system, which has an Asset Value ($AV$) of $\$1,500,000$. Without additional security controls, a critical cyber attack is estimated to occur once every 2 years ($ARO = 0.50$) with an Exposure Factor ($EF$) of $0.30$. The cybersecurity team plans to deploy an endpoint detection and response (EDR) platform alongside network microsegmentation controls, which is expected to reduce the $EF$ to $0.05$ and the $ARO$ to $0.10$. The total annual cost for subscription licensing and maintenance of these controls is $\$45,000$.

What is the net annual financial value (net benefit in USD) of implementing these security controls?

A logistics company evaluates the risk of server downtime at a remote warehouse facility. The database server cluster has an Asset Value ($AV$) of $\$80,000$. An assessment indicates that a severe localized network outage would result in an Exposure Factor ($EF$) of $0.25$ ($25\%$). The Annual Rate of Occurrence ($ARO$) for this type of outage is estimated to be $0.5$ (occurring once every two years). What is the Annualized Loss Expectancy ($ALE$) in USD for this threat?

A financial technology enterprise evaluates a security countermeasure for its core transaction processing portal, which has an Asset Value ($AV$) of $\$4,500,000$. Prior to implementing the safeguard, quantitative risk assessment indicates an Exposure Factor ($EF$) of $0.30$ and an Annualized Rate of Occurrence ($ARO$) of $0.80$.

To mitigate potential impact, the security team deploys a high-availability cloud mitigation service costing $\$48,000$ annually. With this safeguard active, the Exposure Factor ($EF$) drops to $0.05$, but automated threat scanning raises the effective Annualized Rate of Occurrence ($ARO$) to $1.25$.

What is the net annual cost benefit (net safeguard value in USD) realized by deploying this cloud mitigation service?

An organization evaluates the financial impact of a potential security breach on its primary cloud backup repository. The repository has an estimated Asset Value ($AV$) of $\$50,000$. Security analysts determine that a severe ransomware infection would result in an Exposure Factor ($EF$) of $40\%$. What is the Single Loss Expectancy ($SLE$) in dollars for this asset?

An enterprise risk analyst is conducting a quantitative risk assessment for a Payment Card Industry (PCI) transaction processing gateway. The asset value ($AV$) of the server cluster is $\$600,000$. Threat intelligence estimates an Annualized Rate of Occurrence ($ARO$) of $0.40$ for a severe security breach, with an unmitigated Exposure Factor ($EF$) of $30\%$.

To mitigate this risk, the organization deploys a continuous security monitoring and automated data protection control costing $\$15,000$ annually. This control reduces the Exposure Factor ($EF$) to $5\%$ while the $ARO$ remains unchanged.

What is the net annual financial benefit (in USD) of implementing this security control?

An e-commerce enterprise is performing a quantitative risk assessment for its core order processing cluster, which has an estimated Asset Value ($AV$) of $\$750,000$. Security metrics indicate that a ransomware incident affecting this cluster has an Annualized Rate of Occurrence ($ARO$) of $0.20$ and an Exposure Factor ($EF$) of $40\%$. To mitigate this risk, the enterprise plans to deploy an Endpoint Detection and Response (EDR) control costing $\$18,000$ annually. This safeguard will reduce the $EF$ to $10\%$ without affecting the $ARO$. What is the net annual financial benefit, in dollars, of implementing this security safeguard?

A cloud-hosted video rendering cluster maintained by a media organization has an estimated Asset Value ($AV$) of $\$1,500,000$. Operational metrics show that ransomware incidents targeting the rendering nodes have an Annualized Rate of Occurrence ($ARO$) of $0.20$ and an unmitigated Exposure Factor ($EF$) of $0.50$. The organization deploys an automated immutable backup solution costing $\$25,000$ annually. With this safeguard in place, the Exposure Factor ($EF$) for ransomware attacks drops to $0.10$, while the $ARO$ remains unchanged at $0.20$. What is the net annual financial benefit (in USD) realized by implementing this security control?

An enterprise data center hosts a critical database server with an estimated Asset Value ($AV$) of $\$300,000$. Historical threat data indicates that power surge events occur once every 4 years ($\text{ARO} = 0.25$), with each unmitigated event carrying an Exposure Factor ($\text{EF}$) of $30\%$. To mitigate this risk, the organization installs an industrial surge protection system that reduces the Exposure Factor to $5\%$, without altering the frequency of occurrence. What is the new Annualized Loss Expectancy ($\text{ALE}$), in dollars, after implementing this control?

A fintech company operates a cloud-based API gateway handling micro-transactions, with an estimated Asset Value ($AV$) of $\$600,000$. A risk assessment identifies that unmitigated Distributed Denial of Service (DDoS) attacks have an Exposure Factor ($EF$) of $35\%$ and an Annualized Rate of Occurrence ($ARO$) of $0.50$. The organization deploys an automated Web Application Firewall (WAF) that reduces the Exposure Factor to $10\%$. The total annual operational cost of maintaining the WAF is $\$40,000$. What is the net annual financial benefit (in dollars) realized by implementing this security control?

An enterprise cloud service provider assesses a critical customer database system with an estimated Asset Value ($AV$) of $\$1,200,000$. Quantitative risk analysis indicates that an unmitigated database security breach has an Annual Rate of Occurrence ($ARO$) of $0.40$ and results in an Annual Loss Expectancy ($ALE$) of $\$144,000$. What is the Exposure Factor ($EF$), expressed as a percentage, for this potential security incident?

A financial institution is performing a quantitative risk assessment on its central Hardware Security Module (HSM) cluster used for payment cryptographic operations. The HSM cluster has an estimated Asset Value ($AV$) of $\$1,200,000$. A risk analysis team determines that a major key exposure incident would have an Exposure Factor ($EF$) of $0.25$. Threat intelligence models project an Annualized Rate of Occurrence ($ARO$) of $0.15$ for such an incident. What is the calculated Annualized Loss Expectancy ($ALE$) in US dollars for the HSM cluster?

A logistics enterprise operates an automated fleet dispatch server with an Asset Value ($AV$) of $\$300,000$. Historical security data indicates that severe malware incidents impact this server once every four years ($ARO = 0.25$), resulting in an Exposure Factor ($EF$) of $60\%$. To mitigate this risk, the organization plans to deploy an Endpoint Detection and Response (EDR) control that will reduce the Exposure Factor ($EF$) to $10\%$, while the $ARO$ remains unchanged. The total annual cost to license and maintain the EDR solution is $\$12,000$. What is the net annual financial benefit (in USD) of implementing the EDR safeguard?