[Jan 26, 2024] Valid CRISC Test Answers & CRISC Exam PDF [Q17-Q36]

Q17. Della works as a project manager for Tech Perfect Inc. She is studying the documentation of planning of a project. The documentation states that there are twenty-eight stakeholders with the project. What will be the number of communication channels for the project?

250

28

378

300

Q18. Which of the following is the process of numerically analyzing the effects of identified risks on the overall enterprise’s objectives?

Identifying Risks

Quantitative Risk Assessment

Qualitative Risk Assessment

Monitoring and Controlling Risks

Section: Volume B
Explanation:
A quantitative risk assessment quantifies risk in terms of numbers such as dollar values. This involves gathering data and then entering it into standard formulas. The results can help in identifying the priority of risks. These results are also used to determine the effectiveness of controls. Some of the terms associated with quantitative risk assessments are:
* Single loss expectancy (SLE)-It refers to the total loss expected from a single incident. This incident can occur when vulnerability is being exploited by threat. The loss is expressed as a dollar value such as
$1,000. It includes the value of data, software, and hardware.
SLE = Asset value * Exposure factor
* Annual rate of occurrence (ARO)-It refers to the number of times expected for an incident to occur in a year. If an incident occurred twice a month in the past year, the ARO is 24. Assuming nothing changes, it is likely that it will occur 24 times next year.
* Annual loss expectancy (ALE)-It is the expected loss for a year. ALE is calculated by multiplying SLE with ARO. Because SLE is a given in a dollar value, ALE is also given in a dollar value. For example, if the SLE is $1,000 and the ARO is 24, the ALE is $24,000. ALE = SLE * ARO
* Safeguard value-This is the cost of a control. Controls are used to mitigate risk. For example, antivirus software of an average cost of $50 for each computer. If there are 50 computers, the safeguard value is
$2,500.
Incorrect Answers:
A: The first thing we must do in risk management is to identify the areas of the project where the risks can occur. This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
C: Unlike the quantitative risk assessment, qualitative risk assessment does not assign dollar values. Rather, it determines risk’s level based on the probability and impact of a risk. These values are determined by gathering the opinions of experts.
* Probability- establishing the likelihood of occurrence and reoccurrence of specific risks, independently, and combined. The risk occurs when a threat exploits vulnerability. Scaling is done to define the probability that a risk will occur. The scale can be based on word values such as Low, Medium, or High. Percentage can also be assigned to these words, like 10% to low and 90% to high.
* Impact- Impact is used to identify the magnitude of identified risks. The risk leads to some type of loss.
However, instead of quantifying the loss as a dollar value, an impact assessment could use words such as Low, Medium, or High. Impact is expressed as a relative value. For example, low could be 10, medium could be 50, and high could be 100.
Risk level = Probability*Impact
D: This is the process of implementing risk response plans, tracking identified risks, monitoring residual risks, identifying new risks, and evaluating risk process effectiveness through the project.

Q19. You are the project manager for the NHH project. You are working with your project team to examine the project from four different defined perspectives to increase the breadth of identified risks by including internally generated risks. What risk identification approach are you using in this example?

Root cause analysis

Influence diagramming techniques

SWOT analysis

Assumptions analysis

Explanation:
This is an example of SWOT analysis. SWOT analysis examines the strengths, weaknesses,
opportunities, and threats within the project and generated from within the organization.
SWOT stands for Strengths, Weaknesses, Opportunities, and Threats. It is a part of business
policy that helps an individual or a company to make decisions. It includes the strategies to build
the strength of a company and use the opportunities to make the company successful. It also
includes the strategies to overcome the weaknesses of and threats to the company.

is incorrect. Assumptions analysis does not use four pre-defined perspectives for
review.

is incorrect. Root cause analysis examines causal factors for events within the project.

Q20. A business unit is updating a risk register with assessment results for a key project. Which of the following is MOST important to capture in the register?

The team that performed the risk assessment

An assigned risk manager to provide oversight

Action plans to address risk scenarios requiring treatment

The methodology used to perform the risk assessment

Q21. Which of the following is a detective control?

Limit check

Access control software

Periodic access review

Rerun procedures

Q22. The acceptance of control costs that exceed risk exposure is MOST likely an example of:

low risk tolerance.

corporate culture misalignment.

corporate culture alignment.

high risk tolerance

Q23. Which of the following should be the PRIMARY objective of promoting a risk-aware culture within an organization?

Better understanding of the risk appetite

Improving audit results

Enabling risk-based decision making

Increasing process control efficiencies

Q24. Which of the following observations from a third-party service provider review would be of GREATEST concern to a risk practitioner?

Service level agreements (SLAs) have not been met over the last quarter.

The service contract is up for renewal in less than thirty days.

Key third-party personnel have recently been replaced.

Monthly service charges are significantly higher than industry norms.

Q25. Which of the following is the MOST important consideration when developing an organization’s risk taxonomy?

IT strategy

Leading industry frameworks

Business context

Regulatory requirements

Q26. You are the project manager of HFD project. You have identified several project risks. You have adopted alternatives to deal with these risks which do not attempt to reduce the probability of a risk event or its impacts. Which of the following response have you implemented?

Acceptance

Mitigation

Avoidance

Contingent response

Q27. What is the MAIN purpose of designing risk management programs?

To reduce the risk to a level that the enterprise is willing to accept

To reduce the risk to the point at which the benefit exceeds the expense

To reduce the risk to a level that is too small to be measurable

To reduce the risk to a rate of return that equals the current cost of capital

Q28. Who is BEST suited to provide objective input when updating residual risk to reflect the results of control effectiveness?

Control owner

Risk owner

Internal auditor

Compliance manager

Q29. Which of the following would be MOST helpful when communicating roles associated with the IT risk management process?

Skills matrix

Job descriptions

RACI chart

Organizational chart

Q30. During qualitative risk analysis you want to define the risk urgency assessment. All of the following are indicators of risk priority except for which one?

Warning signs

Symptoms

Risk rating

Cost of the project

Q31. Henry is the project manager of the QBG Project for his company. This project has a budget of $4,576,900 and is expected to last 18 months to complete. The CIO, a stakeholder in the project, has introduced a scope change request for additional deliverables as part of the project work. What component of the change control system would review the proposed changes’ impact on the features and functions of the project’s product?

Cost change control system

Configuration management system

Scope change control system

Integrated change control

Q32. Which of the following is MOST helpful to review when identifying risk scenarios associated with the adoption of Internet of Things (loT) technology in an organization?

The business case for the use of loT

The loT threat landscape

Policy development for loT

The network that loT devices can access

Q33. An audit reveals that there are changes in the environment that are not reflected in the risk profile. Which of the following is the BEST course of action?

Review the risk identification process.

Inform the risk scenario owners.

Create a risk awareness communication plan.

Update the risk register.

Q34. Which of the following is the BEST way of managing risk inherent to wireless network?

Enabling auditing on every host that connects to a wireless network

Require private, key-based encryption to connect to the wireless network

Require that the every host that connect to this network have a well-tested recovery plan

Enable auditing on every connection to the wireless network

Q35. You are the risk control professional of your enterprise. You have implemented a tool that correlates information from multiple sources. To which of the following do this monitoring tool focuses?

Transaction data

Process integrity

Configuration settings

System changes

Q36. A penetration test reveals several vulnerabilities in a web-facing application. Which of the following should be the FIRST step in selecting a risk response?

Correct the vulnerabilities to mitigate potential risk exposure.

Develop a risk response action plan with key stakeholders.

Assess the level of risk associated with the vulnerabilities.

Communicate the vulnerabilities to the risk owner.

Leave a Reply Cancel reply