CRISC practice questions 661–670

1. Question 661 · 1449 in bank

   Which of me following groups would provide the MOST relevant perspective when reporting loss exposure based on a risk analysis exercise?

   • AProcess owners
   • BSenior management
   • CInternal auditors
   • DIndependent risk consultants

   Show answer

   Answer: B

   Explanation

   A. Process owners Process owners are directly responsible for the day-to-day management and operation of specific processes within the organization. As a result, they have a deep understanding of the activities, resources, and potential vulnerabilities within their respective areas. When reporting loss exposure based on a risk analysis exercise, process owners can provide the most relevant perspective on the specific risks and potential impact to their processes. Their insights are crucial for accurately assessing the potential loss exposure and determining appropriate risk mitigation strategies within their operational areas.

   Source: Adapted from community discussion — Promz

   Next question

2. Question 662 · 1449 in bank

   When a risk practitioner is developing a set of risk scenarios, the scenarios MUST include information about:

   • Acontrol efficiency
   • Bthreat impact analysis results
   • Cthe relevant threat agents
   • Dthe severity of occurrences

   Show answer

   Answer: C

   Explanation

   When developing a set of risk scenarios, it is essential to include information about the relevant threat agents (option C). Threat agents refer to individuals, groups, or entities that pose a potential risk to an organization or asset. Understanding the nature and capabilities of these threat agents is crucial for developing effective risk scenarios.

   Source: Adapted from community discussion — Joloms

   Next question

3. Question 663 · 1449 in bank

   A risk assessment has revealed that the probability of a successful cybersecurity attack is increasing. The potential loss could exceed the organization’s risk appetite. Which of the following would be the MOST effective course of action?

   • APurchase cybersecurity insurance
   • BRe-evaluate the organization’s risk appetite
   • COutsource the cybersecurity function
   • DReview cybersecurity incident response procedures

   Show answer

   Answer: B

   Explanation

   B. Re-evaluate the organization’s risk appetite Re-evaluating the organization's risk appetite allows management to reassess its tolerance for risk in light of the changing threat landscape. This involves considering whether the organization is willing to accept a higher level of risk or if adjustments need to be made to align with the evolving cybersecurity risks. By re-evaluating the risk appetite, the organization can determine if additional measures are necessary to mitigate the increased risk of cybersecurity attacks.

   Source: Adapted from community discussion — Baddest

   Next question

4. Question 664 · 1449 in bank

   You are an experienced Project Manager that has been entrusted with a project to develop a machine which produces auto components. You have scheduled meetings with the project team and the key stakeholders to identify the risks for your project. Which of the following is a key output of this process?

   • ARisk Register
   • BRisk Management Plan
   • CRisk Breakdown Structure
   • DRisk Categories

   Show answer

   Answer: A

   Explanation

   The primary outputs from Identify Risks are the initial entries into the risk register. The risk register ultimately contains the outcomes of other risk management processes as they are conducted, resulting in an increase in the level and type of information contained in the risk register over time. Incorrect Answers: B, C, D: All these are outputs from the "Plan Risk Management" process, which happens prior to the starting of risk identification.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 665 · 1449 in bank

   You are working as a project manager in Bluewell Inc. You are nearing the final stages of project execution and looking towards the final risk monitoring and controlling activities. For your project archives, which one of the following is an output of risk monitoring and control?

   • AQualitative risk analysis
   • BRisk audits
   • CQuantitative risk analysis
   • DRequested changes

   Show answer

   Answer: D

   Explanation

   Of all the choices given, only requested changes is an output of the monitor and control risks process. You might also have risk register updates, recommended corrective and preventive actions, organizational process assets, and updates to the project management plan. Incorrect Answers: A, C: These are the plan risk management processes. B: Risk audit is a risk monitoring and control technique.

   Source: Adapted from community discussion — Kennethlim79

   Next question

6. Question 666 · 1449 in bank

   Which of the following is the PRIMARY reason to obtain independent reviews of risk assessment and response mechanisms?

   • ATo minimize the subjectivity of risk assessment results
   • BTo correct errors in the risk assessment process
   • CTo ensure risk thresholds are properly defined
   • DTo validate impact and probability ratings

   Show answer

   Answer: A

   Explanation

   B should be the right answer To correct errors in the risk assessment process Independent reviews help identify any flaws, biases, or oversights in the risk assessment process, ensuring its accuracy and reliability. This correction of errors enhances the overall effectiveness of risk management efforts. While the other options (A, C, and D) are also important aspects of risk management, ensuring the accuracy of the risk assessment process through independent reviews is paramount.

   Source: Adapted from community discussion — Baddest

   Next question

7. Question 667 · 1449 in bank

   Which of the following is the MOST important criteria for selecting key risk indicators (KRIs)?

   • AHistorical data availability
   • BSensitivity and reliability
   • CAbility to display trends
   • DImplementation and reporting effort

   Show answer

   Answer: B

   Next question

8. Question 668 · 1449 in bank

   A data privacy regulation has been revised to incorporate more stringent requirements on personal data protection. Which of the following will provide the MOST important input to help ensure compliance with the revised regulation?

   • AGap analysts
   • BRisk profile update
   • CBusiness impact analysis (BIA)
   • DCurrent control attestation

   Show answer

   Answer: C

   Next question

9. Question 669 · 1449 in bank

   Which of the following should be the FIRST course of action if the risk associated with a new technology is found to be increasing?

   • AImplement additional controls
   • BRe-evaluate current controls
   • CRevise the current risk action plan
   • DEscalate the risk to senior management

   Show answer

   Answer: D

   Next question

10. Question 670 · 1449 in bank

    Who should be responsible for approving the cost of controls to be :mplemented for mitigating risk?

    • ARisk owner
    • BControl implementer
    • CControl owner
    • DRisk practitioner

    Show answer

    Answer: A

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 661. 1449 questions available.