Quantitative Risk Assessment Flashcards

An organization calculates that a server failure has a 15% chance of occurring each year and would cost $200,000 to recover. What is the Annual Loss Expectancy (ALE)?

Answer: $30,000

ALE = ARO × SLE = 0.15 × $200,000 = $30,000.

Which metric represents the percentage of an asset's value that would be lost in a single security incident?

Answer: Exposure Factor (EF)

Exposure Factor (EF) is the percentage of asset value lost per incident, used to calculate SLE.

A risk analyst wants to determine the net benefit of implementing a $50,000 security control that reduces ALE from $120,000 to $40,000. What is the value of the control?

Answer: $30,000

Value = (ALE before - ALE after) - cost of control = ($120,000 - $40,000) - $50,000 = $30,000.

In a Monte Carlo simulation for cyber risk, what does running thousands of iterations primarily help quantify?

Answer: The probability distribution of potential losses

Monte Carlo simulations model uncertainty by running many iterations to produce a probability distribution of outcomes.

An asset valued at $500,000 has an exposure factor of 40%. What is the Single Loss Expectancy (SLE)?

Answer: $200,000

SLE = Asset Value × EF = $500,000 × 0.40 = $200,000.

What does a confidence interval of 95% mean in the context of a quantitative cyber risk assessment?

Answer: There is a 95% chance the actual loss will fall within the stated range

A 95% confidence interval means there is a 95% probability the true loss value lies within the calculated range.

Which quantitative risk formula correctly expresses Return on Security Investment (ROSI)?

Answer: ROSI = (ALE Before - ALE After - Control Cost) / Control Cost

ROSI measures the net risk reduction relative to control cost: (ALE reduction - control cost) / control cost.