Calculations and quick-reasoning items

The CISSP is not a mathematics exam, and most candidates see only a handful of items that need arithmetic. Those few items, however, are some of the most reliable marks available, because there is one right answer and no judgement call between two good options. This lesson gathers the calculations the outline and the earlier courses use, works examples of each and shows the traps that make candidates pick the wrong number.

No calculator is provided for most candidates, and the numbers in exam items are usually chosen so that mental arithmetic or a few lines on the provided whiteboard are enough. Practise doing these by hand. Hannah, who works with risk numbers daily, finds this lesson easy; Tomás, who is comfortable with network maths, has to slow down on the risk formulas.

Quantitative risk: SLE, ARO and ALE

The most common calculation on the exam is quantitative risk analysis from CISSP-110. Four quantities are involved. The asset value (AV) is what the asset is worth. The exposure factor (EF) is the share of that value lost in one incident. The single loss expectancy (SLE) is the loss from one incident. The annualized rate of occurrence (ARO) is how often the incident is expected per year. The annualized loss expectancy (ALE) is the expected loss per year.

The value of a safeguard compares the reduction in annual loss with the safeguard's annual cost. A safeguard is justified on cost grounds when this value is positive.

Three traps account for most wrong answers. The first is confusing ARO with a time interval: 'once every 25 years' is an ARO of 0.04, not 25. The second is comparing the safeguard's cost with the SLE rather than with the reduction in ALE. The third is forgetting that a safeguard can change either the exposure factor or the rate of occurrence; read which one the item says it changes.

Qualitative risk and risk matrices

Not every risk item uses currency. Qualitative analysis rates likelihood and impact on scales such as low, medium and high, or 1 to 5, and combines them into a risk level, often by multiplying or by reading a matrix. Items in this family usually ask which risk should be treated first. The answer is the one with the highest combined rating, unless the item adds a constraint such as a legal requirement or a risk to life, which changes the priority.

Continuity numbers: MTD, RTO, RPO and WRT

Business continuity items use several time measures from CISSP-110 and CISSP-116. The maximum tolerable downtime (MTD), also called the maximum tolerable period of disruption, is the longest a business function can be unavailable before the harm becomes unacceptable. The recovery time objective (RTO) is the target time to restore a system. The work recovery time (WRT) is the time needed after systems return to verify data and resume normal work. The recovery point objective (RPO) is the maximum acceptable amount of data loss, measured in time.

The key relationship is that recovery must fit within the tolerable downtime: \(\text{RTO} + \text{WRT} \le \text{MTD}\). If the MTD for payment processing is 8 hours and staff need 2 hours to verify and catch up after systems return, the RTO must be no more than 6 hours. RPO is independent of RTO and drives backup frequency, as lesson 8 showed.

Availability: MTBF and MTTR

Operations items sometimes ask about reliability. The mean time between failures (MTBF) is the average operating time between failures; the mean time to repair (MTTR) is the average time to restore service after a failure. Availability is the share of time a system is working.

Two components that must both work, in series, have a combined availability equal to the product of their availabilities, which is lower than either. Two redundant components, in parallel, where either can carry the load, have a combined unavailability equal to the product of their unavailabilities, which is much lower than either. This is why redundancy improves availability so dramatically.

Keys, entropy and combinations

Lesson 6 introduced key counts: a group of n people needs \(n(n-1)/2\) symmetric keys or \(2n\) asymmetric keys. A related item asks about the size of a key space. A key of k bits has \(2^k\) possible values, so each extra bit doubles the work of a brute-force search. A password of length L drawn from an alphabet of N characters has \(N^L\) possible values, and its entropy in bits is \(L \log_2 N\). These items usually ask which change increases strength most; length usually beats a slightly larger alphabet.

One caution matters for the exam's manager-level items: entropy figures assume random choice. Human-chosen passwords are far weaker than these numbers suggest, which is why the guidance from CISSP-114 favours long passphrases, screening against known breached passwords, multifactor authentication and, increasingly, passkeys, rather than complex composition rules.

Other quick-reasoning items

A few other calculations appear occasionally. Network items may ask how many usable host addresses a subnet provides: a prefix of /n leaves \(32 - n\) host bits, giving \(2^{32-n} - 2\) usable addresses in a traditional IPv4 subnet. Backup items may ask how many tapes or sets are needed to restore after a failure: a full backup plus every incremental since then, or a full backup plus only the latest differential. Testing items may ask about test coverage as a percentage of paths, functions or requirements exercised.

Reading numeric options

Calculation items are designed so that each common mistake produces one of the wrong options. If you compute an ALE and your answer matches an option, check that you did not land on the number a typical error would produce, such as the SLE or the result of multiplying by the interval instead of the rate. A quick sanity check helps: the ALE for a rare event should be much smaller than the SLE, availability in series should be lower than either component, and a parallel pair should be higher than either. If your answer fails the sanity check, recalculate before confirming, because there is no going back.

Write intermediate values on the whiteboard rather than holding them in your head. Tomás's habit is to write the formula first, then the numbers, then the result, which takes ten seconds longer and prevents most slips. Units matter too: keep hours with hours and money with money, and convert percentages to decimals before multiplying.

Checking the arithmetic

The program below works through every calculation in this lesson so that Hannah and Tomás can change the numbers and check their hand calculations. Practising with it a few times builds the speed that matters on the day.

import math

# Quantitative risk
av, ef, aro = 2_000_000, 0.40, 1 / 25
sle = av * ef; ale = sle * aro
ale_after = av * 0.10 * aro
print(f"SLE {sle:,.0f}  ALE {ale:,.0f}  ALE after barrier {ale_after:,.0f}  value {ale - ale_after - 20_000:,.0f}")

# Continuity
mtd, wrt = 12, 3
print(f"Maximum RTO = {mtd - wrt} hours")

# Availability
a = 0.99
print(f"Series {a * a:.4%}  Parallel {1 - (1 - a) ** 2:.4%}")
mtbf, mttr = 2000, 4
print(f"Availability with MTBF {mtbf} h and MTTR {mttr} h = {mtbf / (mtbf + mttr):.3%}")

# Entropy
for n_chars, length in [(26, 8), (72, 8), (26, 16), (72, 16)]:
    print(f"N={n_chars:>2} L={length:>2}: {length * math.log2(n_chars):5.1f} bits")

# Subnet hosts
for prefix in (24, 26, 28):
    print(f"/{prefix}: {2 ** (32 - prefix) - 2} usable hosts")

SLE 800,000  ALE 32,000  ALE after barrier 8,000  value 4,000
Maximum RTO = 9 hours
Series 98.0100%  Parallel 99.9900%
Availability with MTBF 2000 h and MTTR 4 h = 99.800%
N=26 L= 8:  37.6 bits
N=72 L= 8:  49.4 bits
N=26 L=16:  75.2 bits
N=72 L=16:  98.7 bits
/24: 254 usable hosts
/26: 62 usable hosts
/28: 14 usable hosts

Every number in the output matches the worked examples and tables above. The MTBF line is a small extra: a device that fails on average every 2,000 hours and takes 4 hours to repair is available about 99.8 % of the time, which is roughly 17.5 hours of downtime a year.

Patterns to remember