Main exam topics
Governance, policies, standards and roles; risk assessment and treatment; vendor oversight; compliance and privacy; audits and assessments; security awareness; annualized loss expectancy = single loss expectancy × annual rate of occurrence.
SY0-701 topic overview · Independent study resource, not a prediction of exam questions.
Scenario summary
Annualized loss expectancy equals single loss expectancy multiplied by annual rate of occurrence. A $20,000 loss once every five years has an annual rate of 1 ÷ 5 = 0.2, so ALE = $20,000 × 0.2 = $4,000. Compare safeguard costs and expected risk reduction against this estimate; do not multiply the loss by five.
Security+ practice scenario · Full concepts below
Governance sets expectations and ownership. Risk management identifies and evaluates uncertainty, while compliance demonstrates that specific requirements have been met. Neither a checklist nor a tool eliminates all risk.
Key terms & acronyms
- Policy
- High-level management expectations.
- SLE
- Expected monetary loss from a single event.
- ARO
- Expected frequency of an event per year.
- ALE
- Annualized loss expectancy: SLE multiplied by ARO.
Concepts at a glance
| Concept | Purpose | Example |
|---|---|---|
| Avoid | Stop the risky activity | Do not launch an unsafe service |
| Mitigate | Reduce likelihood or impact | Add safeguards |
| Transfer | Shift financial consequences | Insurance or contractual terms |
| Accept | Acknowledge within tolerance | Document approved residual risk |
In the workplace
An incident costs $20,000 and happens once every five years. ARO is 0.2; ALE is $4,000. Before outsourcing customer data, evaluate the vendor’s controls, contract, data handling and incident-notification obligations.
Common mistakes & scenario tips
Compliance is not proof of security. A passing audit can coexist with an unpatched system. Awareness programs should measure behavior and support reporting rather than shame employees.