Which analysis element justifies removing ransomware coverage to reduce insurance costs?
A company decided to reduce the cost of its annual cyber insurance policy by removing the coverage for ransomware attacks. Which of the following analysis elements did the company most likely use in making this decision?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
This question tests quantitative risk analysis concepts, specifically ARO, while the common trap is confusing time-based recovery metrics (MTTR, RTO, MTBF) with frequency-based risk metrics.
The company most likely used Annualized Rate of Occurrence (ARO) to evaluate the expected frequency of ransomware incidents and determine that the probability did not justify the insurance premium. Community consensus strongly confirms ARO as the correct choice, with voters noting the keyword 'annual' as a direct clue.
Many candidates incorrectly choose MTTR or RTO because they associate cyber insurance with recovery time, failing to recognize that the decision is about the frequency (rate) of occurrence, not recovery duration.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Annualized Rate of Occurrence (ARO) represents the estimated frequency of a specific threat occurring within a one-year period. By calculating the ARO for ransomware, the company could quantify how often such an attack was expected and weigh that against the annual insurance premium. Comment [4] correctly notes that the company used ARO to assess likelihood and concluded the probability did not justify the coverage cost. The word 'annual' in the question stem is a strong keyword indicator pointing directly to ARO, as highlighted by comment [3].Why the Other Options Are Wrong
MTTR (Mean Time to Repair) measures the average time required to fix a system after a failure, not the frequency of the event. RTO (Recovery Time Objective) defines the maximum acceptable downtime after a disaster, which relates to recovery planning rather than risk frequency analysis. MTBF (Mean Time Between Failures) is a reliability metric indicating the expected time between hardware or system failures, and does not address the likelihood of a specific threat like ransomware. Comment [1] and [2] provide clear definitions that distinguish these time-based metrics from the frequency-based ARO.Community Comment Notes
The community overwhelmingly supports option C with 100% of votes. Comment [3] offers a practical exam tip by noting that the word 'annual' is a direct clue to ARO. Comment [1] and [2] provide helpful definitions of all four acronyms, reinforcing the distinction between time-based and frequency-based metrics. Comment [4] adds valuable context by explaining how ARO directly informs the cost-benefit analysis of insurance coverage.Official Reference
Exam Strategy
When you see the word 'annual' in a risk management question, immediately think of Annualized Rate of Occurrence (ARO). Distinguish between frequency-based metrics (ARO, SLE, ALE) and time-based metrics (MTTR, RTO, MTBF) to avoid common traps.
Related Analysis
Practice All SY0-701 Questions
Access 100 questions with complete answers and detailed explanations.
View Full SY0-701 Practice Test →