Which analysis element justifies removing ransomware coverage to reduce insurance costs?

SY0-701 By islever Editorial Last updated

Short answer

C ARO

Question

A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision?
  1. MTTR
  2. RTO
  3. ARO Correct Answer
  4. MTBF

Key Takeaways

This question tests quantitative risk analysis concepts, specifically ARO, while the common trap is confusing time-based recovery metrics (MTTR, RTO, MTBF) with frequency-based risk metrics.

The company most likely used Annualized Rate of Occurrence (ARO) to evaluate the expected frequency of ransomware incidents and determine that the probability did not justify the insurance premium. Community consensus strongly confirms ARO as the correct choice, with voters noting the keyword 'annual' as a direct clue.

Common mistake: Many candidates incorrectly choose MTTR or RTO because they associate cyber insurance with recovery time, failing to recognize that the decision is about the frequency (rate) of occurrence, not recovery duration.

Expert Analysis

Why the Answer Is Correct

Annualized Rate of Occurrence (ARO) represents the estimated frequency of a specific threat occurring within a one-year period. By calculating the ARO for ransomware, the company could quantify how often such an attack was expected and weigh that against the annual insurance premium. Comment [4] correctly notes that the company used ARO to assess likelihood and concluded the probability did not justify the coverage cost. The word 'annual' in the question stem is a strong keyword indicator pointing directly to ARO, as highlighted by comment [3].

Why the Other Options Are Wrong

MTTR (Mean Time to Repair) measures the average time required to fix a system after a failure, not the frequency of the event. RTO (Recovery Time Objective) defines the maximum acceptable downtime after a disaster, which relates to recovery planning rather than risk frequency analysis. MTBF (Mean Time Between Failures) is a reliability metric indicating the expected time between hardware or system failures, and does not address the likelihood of a specific threat like ransomware. Comment [1] and [2] provide clear definitions that distinguish these time-based metrics from the frequency-based ARO.

Community Comment Notes

The community overwhelmingly supports option C with 100% of votes. Comment [3] offers a practical exam tip by noting that the word 'annual' is a direct clue to ARO. Comment [1] and [2] provide helpful definitions of all four acronyms, reinforcing the distinction between time-based and frequency-based metrics. Comment [4] adds valuable context by explaining how ARO directly informs the cost-benefit analysis of insurance coverage.

Official Reference

https://www.comptia.org/certifications/security

This link opens the official vendor documentation in a new tab.

Exam Strategy

When you see the word 'annual' in a risk management question, immediately think of Annualized Rate of Occurrence (ARO). Distinguish between frequency-based metrics (ARO, SLE, ALE) and time-based metrics (MTTR, RTO, MTBF) to avoid common traps.

Community Votes

C
100%

100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 5

  1. e5c1bb5 👍 26 Answered C
    MTTR= mean time to repair RTO=recovery time objective ARO= annualized rate of occurance MTBF= mean time between failures. ARO is it
  2. barracouto 👍 13 Answered C
    MTTR (Mean Time to Repair): This measures the average time it takes to repair a system or component after a failure. It is used to assess how quickly an organization can respond to and fix issues. RTO (Recovery Time Objective): This is the maximum acceptable amount of time that a system or application can be down after a failure or disaster. It defines the target time for recovery. ARO (Annualized Rate of Occurrence): This estimates the frequency with which a specific risk or event is expected to occur in a year. It helps in assessing the likelihood of risks. MTBF (Mean Time Between Failures): This measures the average time between failures of a system or component. It is used to predict the reliability and performance of systems over time. In the context of the company deciding to remove ransomware coverage to reduce costs, they likely assessed the ARO (Annualized Rate of Occurrence) to determine how often ransomware attacks are expected to occur and decided the risk was low enough to justify the cost savings.
  3. dbrowndiver 👍 1 Answered C
    In this scenario, option C. ARO (Annualized Rate of Occurrence) is the correct answer because it assesses the frequency of ransomware attacks. The company likely used ARO to evaluate the likelihood of such incidents occurring and decided that the probability did not justify the cost of insurance coverage for ransomware, leading to the decision to reduce the policy cost.
  4. itone333 👍 1 Answered C
    Soon as I saw the word 'annual', I already knew what time it was.
  5. MaxiPrince 👍 1 Answered C
    annualized rate of occurance

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

Which Zero Trust Component Belongs to the Data Plane?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide