Question

A financial services firm operates a customer-facing web application. A quantitative risk assessment estimates the application's asset value at $2,000,000. A successful web-based attack is expected to destroy 25% of that value (exposure factor), and threat intelligence indicates such a compromise is likely to occur twice per year. The security team proposes a web application firewall and monitoring solution costing $180,000 annually, which is expected to reduce the frequency of successful attacks to once every two years. Using quantitative risk analysis, which statement best justifies the investment decision?

Accepted Answer

The control should be approved because it reduces the annual loss expectancy from $1,000,000 to $250,000, a savings of $750,000 that far exceeds the $180,000 cost.

Answer

The control should be rejected because the $180,000 annual cost exceeds the $500,000 single loss expectancy.

Answer

The control should be rejected because the single loss expectancy of $500,000 is lower than the combined annual cost of the control over two years.

Answer

The control should be approved because it eliminates all residual risk, bringing the annualized loss expectancy to zero.