ExamSprintLab

Risk calculation practice questions

Updated October 9, 2026

Fifteen free risk calculation practice questions with explained answers, covering single loss expectancy (SLE), annualized rate of occurrence (ARO), annualized loss expectancy (ALE), cost-of-control decisions and the four risk treatments. Quantitative risk analysis puts a money value on a risk using SLE = asset value x exposure factor and ALE = SLE x ARO. The calculations appear in objective 5.2 of Security+ SY0-801, and every figure below was recomputed in code.

How to use these questions

  • Attempt each question on paper before opening the answer. Write SLE, ARO and ALE as separate lines.
  • Note the constraint word: “single” stops at SLE, “per year” or “annualized” means multiply by ARO.
  • Convert “once every N years” to an ARO of 1/N before anything else.
  • The topic guide qualitative vs quantitative risk explains the formulas and the cost-benefit rule.

Warm-up: SLE, ARO and ALE

Question 1. An application server is valued at 200,000. Analysts estimate that a successful attack would destroy 25 percent of that value. What is the single loss expectancy (SLE)?

  • A. 25,000
  • B. 175,000
  • C. 50,000
  • D. 800,000
Show answer

Answer: C

SLE = asset value x exposure factor = 200,000 x 0.25 = 50,000. 25,000 is the exposure factor treated as a currency amount. 175,000 is the value that remains after the loss, not the loss itself. 800,000 divides by 0.25 instead of multiplying.

Question 2. A single loss is estimated at 40,000, and the event is expected about once every five years. What is the annualized loss expectancy (ALE)?

  • A. 8,000
  • B. 200,000
  • C. 40,000
  • D. 20,000
Show answer

Answer: A

Once every five years is an ARO of 0.2, so ALE = 40,000 x 0.2 = 8,000. 200,000 multiplies by 5, which uses the number of years as if it were the ARO. 40,000 is only the SLE. 20,000 has no basis in the formula.

Question 3. A phishing campaign is expected to hit a company twice per year. Each successful incident costs about 3,500 in cleanup and lost work. What is the ALE?

  • A. 1,750
  • B. 3,500
  • C. 10,500
  • D. 7,000
Show answer

Answer: D

ARO is 2, so ALE = 3,500 x 2 = 7,000. 1,750 divides by the ARO. 3,500 is the SLE alone. 10,500 multiplies by 3, which has no basis in the figures given.

Question 4. A web server is worth 120,000. A compromise would cost 35 percent of its value and is expected once every four years. What is the ALE?

  • A. 42,000
  • B. 10,500
  • C. 168,000
  • D. 4,200
Show answer

Answer: B

SLE = 120,000 x 0.35 = 42,000. ARO = 1/4 = 0.25. ALE = 42,000 x 0.25 = 10,500. 42,000 stops at the SLE. 168,000 multiplies the SLE by 4 instead of dividing. 4,200 has no basis in the formula.

Question 5. A risk register entry states that a regional power outage is expected once every eight years. Which ARO should be used in the ALE formula?

  • A. 0.125
  • B. 8
  • C. 0.8
  • D. 12.5
Show answer

Answer: A

ARO is the expected number of occurrences per year, so one event in eight years is 1/8 = 0.125. 8 is the interval in years, not a rate. 0.8 is a rounding of the wrong ratio. 12.5 is 100 divided by 8, mixing in a percentage.

Scenarios: cost of the control and risk treatment

Question 6. A risk has an ALE of 60,000. A proposed control costs 40,000 per year and lowers the ALE to 15,000. What is the correct conclusion?

  • A. Not justified, because the cost exceeds the remaining ALE of 15,000
  • B. Justified, because the control eliminates the risk
  • C. The control cannot be judged without a qualitative rating
  • D. Justified, because the 45,000 reduction exceeds the 40,000 cost
Show answer

Answer: D

The ALE falls by 45,000 and the control costs 40,000 per year, a net benefit of 5,000, so the control is justified. Comparing the control cost with the remaining ALE (15,000) is the wrong test. Residual risk of 15,000 remains, so the risk is reduced, not eliminated. Qualitative ratings are not needed when the figures are already quantified.

Question 7. A data store is valued at 250,000, and an incident would cost 60 percent of it, expected once every two years. Which option has the highest annual net benefit? Option 1 cuts the ARO to 0.1 and costs 30,000 per year. Option 2 cuts the exposure factor to 20 percent and costs 15,000 per year. Option 3 is an insurance policy covering the whole loss at 80,000 per year. Option 4 is to accept the risk.

  • A. Option 1
  • B. Option 2
  • C. Option 3
  • D. Option 4
Show answer

Answer: B

Baseline ALE = 250,000 x 0.6 x 0.5 = 75,000. Option 1 gives ALE 15,000, a 60,000 reduction, net 30,000. Option 2 gives ALE 25,000, a 50,000 reduction, net 35,000, the highest. Option 3 removes 75,000 of ALE but costs 80,000, net -5,000. Accepting has a net benefit of 0 by definition.

Question 8. A shop has an ALE of 9,000 for flood damage to its stock. It buys a policy for 6,000 per year that pays the full loss if a flood occurs. Which risk treatment is this?

  • A. Accept
  • B. Avoid
  • C. Transfer
  • D. Mitigate
Show answer

Answer: C

Insurance moves the financial consequence to another party, which is transferring the risk, and the premium is lower than the ALE. Accepting would mean bearing the loss itself. Avoiding would mean ceasing the activity or leaving the flood zone. Mitigating would mean reducing the likelihood or impact, for example with flood barriers, which insurance does not do.

Question 9. A server worth 150,000 loses 20 percent of its value in an incident, and incidents occur three times per year. After network segmentation is deployed, incidents are expected once per year with the same impact. What is the residual ALE?

  • A. 30,000
  • B. 90,000
  • C. 60,000
  • D. 10,000
Show answer

Answer: A

SLE = 150,000 x 0.20 = 30,000. With an ARO of 1 the residual ALE is 30,000. 90,000 is the ALE before the control (30,000 x 3), the inherent figure. 60,000 is the reduction achieved, not what remains. 10,000 divides instead of multiplying.

Question 10. A start-up has no incident history and wants a quick ranking of its top risks before a planning workshop. Which approach fits best?

  • A. Quantitative analysis with SLE and ALE for every risk
  • B. Qualitative analysis with likelihood and impact ratings
  • C. Calculate one ALE and apply it to all risks
  • D. Wait for incidents to occur and then assess the risks
Show answer

Answer: B

Qualitative analysis rates likelihood and impact on scales or a heat map, needs no historical data and is fast. Quantitative analysis needs reliable asset values and event frequencies, which this company lacks. A single ALE calculation presumes those inputs. Waiting for incidents to build history is not a risk assessment approach.

Edge cases and traps

Question 11. A database worth 300,000 suffers a 50 percent loss in a breach, expected once every two years. Encrypting the data reduces the exposure factor to 20 percent. By how much does the ALE fall?

  • A. 30,000
  • B. 75,000
  • C. 120,000
  • D. 45,000
Show answer

Answer: D

Before: 300,000 x 0.5 x 0.5 = 75,000. After: 300,000 x 0.2 x 0.5 = 30,000. The reduction is 45,000. 30,000 is the ALE after the control. 75,000 is the ALE before. 120,000 has no basis in the formula.

Question 12. A control reduces the ALE of a 400,000 asset (exposure factor 30 percent, ARO 0.5) by lowering the ARO to 0.1. It costs 90,000 up front, lasts three years, and needs 5,000 per year in maintenance. What is the annual net benefit?

  • A. 48,000
  • B. 43,000
  • C. 13,000
  • D. 18,000
Show answer

Answer: C

ALE before = 400,000 x 0.3 x 0.5 = 60,000. ALE after = 400,000 x 0.3 x 0.1 = 12,000. Reduction = 48,000. Annual cost = 90,000 / 3 + 5,000 = 35,000. Net = 48,000 - 35,000 = 13,000. 48,000 ignores the cost. 43,000 ignores the up-front cost. 18,000 ignores the maintenance.

Question 13. A low-priority internal wiki has an ALE of 1,200. The only available control costs 5,000 per year, and no cheaper alternative exists. What is the most reasonable treatment?

  • A. Accept the risk
  • B. Mitigate by buying the control
  • C. Avoid the risk by shutting the wiki down
  • D. Transfer the risk by buying a second control
Show answer

Answer: A

When the control costs more than the loss it prevents, accepting the risk is rational and is a legitimate treatment, usually with management sign-off. Buying the control loses money each year. Avoiding the risk by shutting the wiki down gives up value to prevent a small loss. Transfer needs an insurer or contract at a price below the ALE, and none is offered.

Question 14. An asset is valued at 500,000. Each incident destroys 15 percent of it, and four incidents occurred in the last ten years. Assuming that history continues, what is the ALE?

  • A. 75,000
  • B. 300,000
  • C. 187,500
  • D. 30,000
Show answer

Answer: D

SLE = 500,000 x 0.15 = 75,000. ARO = 4 / 10 = 0.4. ALE = 75,000 x 0.4 = 30,000. 75,000 is the SLE. 300,000 multiplies the SLE by 4, the number of incidents. 187,500 multiplies by 2.5, which inverts the ratio.

Question 15. Three risks are to be ranked by ALE. Risk X: asset 600,000, exposure factor 10 percent, once per year. Risk Y: asset 100,000, exposure factor 80 percent, once every two years. Risk Z: asset 1,000,000, exposure factor 5 percent, once every two years. Which should be addressed first?

  • A. Risk Y, because it has the highest SLE
  • B. Risk Z, because it has the highest asset value
  • C. Risk X
  • D. All three equally, because the ALEs are the same
Show answer

Answer: C

ALE for X = 60,000 x 1 = 60,000. Y = 80,000 x 0.5 = 40,000. Z = 50,000 x 0.5 = 25,000. X is highest. Y has the highest SLE but occurs less often. Z has the highest asset value but the smallest exposure factor. The ALEs are all different, so there is no tie.

Where to go next

Read the topic guide qualitative vs quantitative risk, then try security controls practice questions and Zero Trust and IAM practice questions. For a longer set, take the free 20-question SY0-801 practice test. For technique on wording traps, see multiple-choice exam tips.