Examkin

Soru

Zorluk: OrtaRisk Identification, Assessment, and Response Strategies

A risk analyst is conducting a quantitative risk assessment for a database server hosting core enterprise operational data. The Asset Value (AVAV) of the server is established at $500,000\$500,000. Threat intelligence data indicates that a major ransomware incident targeting this database occurs approximately once every 5 years. Financial modeling determines that the Annual Loss Expectancy (ALEALE) for this threat scenario is $25,000\$25,000. Based on these quantitative metrics, what is the Exposure Factor (EFEF) associated with a single ransomware incident?

  1. 25%Cevap
  2. B
    5%
  3. C
    20%
  4. D
    80%

Cevap

The Exposure Factor (EF) associated with a single ransomware incident is 25%.
The Exposure Factor (EFEF) measures the percentage of an asset destroyed or damaged during a single threat occurrence. Given ALE=$25,000ALE = \$25,000 and ARO=0.20ARO = 0.20 (once every 5 years), the Single Loss Expectancy (SLESLE) is $25,000/0.20=$125,000\$25,000 / 0.20 = \$125,000. Dividing SLESLE by the total Asset Value (AV=$500,000AV = \$500,000) gives EF=$125,000/$500,000=0.25EF = \$125,000 / \$500,000 = 0.25, or 25%.

Adım Adım Çözüm

1
Calculate the Annual Rate of Occurrence (ARO)
ARO=15 years=0.20ARO = \frac{1}{\text{5 years}} = 0.20
The event occurs once every 5 years, giving an annual frequency of 0.20.
2
Calculate the Single Loss Expectancy (SLE) from ALE and ARO
SLE=ALEARO=$25,0000.20=$125,000SLE = \frac{ALE}{ARO} = \frac{\$25,000}{0.20} = \$125,000
Since ALE=SLE×AROALE = SLE \times ARO, dividing ALEALE by AROARO yields the expected monetary loss per single incident.
3
Calculate the Exposure Factor (EF)
EF=SLEAV=$125,000$500,000=0.25 or 25%EF = \frac{SLE}{AV} = \frac{\$125,000}{\$500,000} = 0.25 \text{ or } 25\%
The Exposure Factor represents the percentage of asset value lost during a single realization of a risk (SLE=AV×EFSLE = AV \times EF).

Anahtar Kavram

Quantitative Risk Assessment Metrics (ALE, SLE, ARO, EF)
Bu soruyu puanla

Konular

Risk Identification, Assessment, and Response Strategies

Bu konudan daha fazla soru