CompTIA Security+ (SY0-501) — Question 797

A security analyst is performing a quantitative risk analysis. The risk analysis should show the potential monetary loss each time a threat or event occurs. Given this requirement, which of the following concepts would assist the analyst in determining this value? (Choose two.)

Answer options

• A. ALE
• B. AV
• C. ARO
• D. EF
• E. ROI

Correct answer: B, D

Explanation

The correct answers are AV (Asset Value) and EF (Exposure Factor), as these concepts directly relate to determining the monetary impact of threats. ALE (Annual Loss Expectancy) and ROI (Return on Investment) are important in risk management but do not specifically aid in calculating the potential loss per event. ARO (Annual Rate of Occurrence) is also relevant but does not provide the specific monetary value needed in this context.