CRISC practice questions 721–730

1. Question 721 · 1449 in bank

   Select 3

   You are the risk professional of your enterprise. You have performed cost and benefit analysis of control that you have adopted. What are all the benefits of performing cost and benefit analysis of control? Each correct answer represents a complete solution. (Choose three.)

   • AIt helps in determination of the cost of protecting what is important
   • BIt helps in taking risk response decisions
   • CIt helps in providing a monetary impact view of risk
   • DIt helps making smart choices based on potential risk mitigation costs and losses

   Show answer

   Answer: ABD

   Explanation

   The benefits of performing cost and benefit analysis of controls helps in taking risk response decisions: Cost and benefit analysis of controls can help in taking risk response decisions by providing information on the potential costs and benefits of different risk management strategies. I would choose ABD

   Source: Adapted from community discussion — Gachoki

   Next question

2. Question 722 · 1449 in bank

   Select 3

   What are the steps that are involved in articulating risks? Each correct answer represents a complete solution. (Choose three.)

   • AIdentify business opportunities.
   • BIdentify the response
   • CCommunicate risk analysis results and report risk management activities and the state of compliance.
   • DInterpret independent risk assessment findings.

   Show answer

   Answer: BCD

   Explanation

   Following are the tasks that are involved in articulating risk: ✑ Communicate risk analysis results. ✑ Report risk management activities and the state of compliance. ✑ Interpret independent risk assessment findings. ✑ Identify business opportunities.

   Source: Adapted from community discussion — Ravnit

   Next question

3. Question 723 · 1449 in bank

   How residual risk can be determined?

   • ABy determining remaining vulnerabilities after countermeasures are in place.
   • BBy transferring all risks.
   • CBy threat analysis
   • DBy risk assessment

   Show answer

   Answer: A

   Explanation

   A. By determining remaining vulnerabilities after countermeasures are in place. Residual risk is the risk that remains after security countermeasures have been implemented. It represents the level of risk that an organization or system still faces even with the security controls and measures in place. To determine the residual risk, you assess the vulnerabilities that are still present or partially mitigated after implementing security measures, and you evaluate the potential impact of these remaining vulnerabilities. This helps in understanding the level of risk that the organization or system still needs to manage and be aware of.

   Source: Adapted from community discussion — SuperMax

   Next question

4. Question 724 · 1449 in bank

   You are elected as the project manager of GHT project. You are in project initialization phase and are busy in defining requirements for your project. While defining requirements you are describing how users will interact with a system. Which of the following requirements are you defining here?

   • ATechnical requirement
   • BProject requirement
   • CFunctional requirement
   • DBusiness requirement

   Show answer

   Answer: C

   Explanation

   While defining requirements, there is need to define three requirements of the project- Business requirement, Functional requirement, and Technical requirement Functional requirements and use case models describe how users will interact with a system. Therefore here in this stem you are defining the functional requirement of the project. Incorrect Answers: A: Technical requirements and design specifications and coding specifications describe how the system will interact, conditions under which the system will operate and the information criteria the system should meet. B: Business requirement, Functional requirement, and Technical requirement come under project requirement. In this stem it is particular defining the functional requirement, hence this is not the best answer. D: Business requirements contain descriptions of what a system should do.

   Source: Adapted from community discussion — SuperMax

   Next question

5. Question 725 · 1449 in bank

   Which of the following is a technique that provides a systematic description of the combination of unwanted occurrences in a system?

   • ASensitivity analysis
   • BScenario analysis
   • CFault tree analysis
   • DCause and effect analysis

   Show answer

   Answer: C

   Explanation

   Fault tree analysis (FIA) is a technique that provides a systematic description of the combination of possible occurrences in a system, which can result in an undesirable outcome. It combines hardware failures and human failures. Incorrect Answers: A: Sensitivity analysis is the quantitative risk analysis technique that: Assist in determination of risk factors that have the most potential impact Examines the extent to which the uncertainty of each element affects the object under consideration when all other uncertain elements are held at their baseline values B: This analysis provides ability to see a range of values across several scenarios to identify risk in specific situation. It provides ability to identify those inputs which will provide the greatest level of uncertainty. D: Cause-and-effect analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes. These tools also help in identifying potential risk.

   Source: Adapted from community discussion — SuperMax

   Next question

6. Question 726 · 1449 in bank

   While considering entity-based risks, which dimension of the COSO ERM framework is being referred?

   • AOrganizational levels
   • BRisk components
   • CStrategic objectives
   • DRisk objectives

   Show answer

   Answer: A

   Explanation

   The organizational levels of the COSO ERM framework describe the subsidiary, business unit, division, and entity-levels of aspects of risk solutions. Incorrect Answers: B: Risk components includes Internal Environment, Objectives settings, Event identification, Risk assessment, Risk response, Control activities, Information and communication, and monitoring. C: Strategic objectives includes strategic, operational, reporting, and compliance risks; and not entity-based risks. D: This is not a valid answer.

   Source: Adapted from community discussion — eblue

   Next question

7. Question 727 · 1449 in bank

   You are the project manager for Bluewell Inc. You are studying the documentation of project plan. The documentation states that there are twenty-five stakeholders with the project. What will be the number of communication channel s for the project?

   • A20
   • B100
   • C50
   • D300

   Show answer

   Answer: D

   Explanation

   Communication channels are paths of communication with stakeholders in a project. The number of communication channels shows the complexity of a project's communication and can be derived through the formula shown below: Total Number of Communication Channels = n (n-1)/2 where n is the number of stakeholders. Hence, a project having five stakeholders will have ten communication channels. Putting the value of the number of stakeholders in the formula will provide the number of communication channels. Hence, Number of communication channel = (n (n-1)) / 2 = (25 (25-1)) / 2 = (25 x 24) / 2 = 600 / 2 = 300 Incorrect Answers: A, B, C: These are not valid number of communication channels for the given scenario.

   Next question

8. Question 728 · 1449 in bank

   Select 3

   Which of the following are the common mistakes while implementing KRIs? Each correct answer represents a complete solution. (Choose three.)

   • AChoosing KRIs that are difficult to measure
   • BChoosing KRIs that has high correlation with the risk
   • CChoosing KRIs that are incomplete or inaccurate due to unclear specifications
   • DChoosing KRIs that are not linked to specific risk

   Show answer

   Answer: ACD

   Explanation

   A common mistake when implementing KRIs other than selecting too many KRIs includes choosing KRIs that are: ✑ Not linked to specific risk ✑ Incomplete or inaccurate due to unclear specifications ✑ Too generic ✑ Difficult to aggregate, compare and interpret ✑ Difficult to measure Incorrect Answers: B: For ensuring high reliability of the KRI, The indicator must possess a high correlation with the risk and be a good predictor or outcome measure. Hence KRIs are chosen that has high correlation with the risk.

   Next question

9. Question 729 · 1449 in bank

   Which of the following control audit is performed to assess the efficiency of the productivity in the operations environment?

   • AOperational
   • BFinancial
   • CAdministrative
   • DSpecialized

   Show answer

   Answer: A

   Explanation

   The administrative audit is used to assess the efficiency of the productivity in the operations environment. Incorrect Answers: A: It evaluates the internal control structure of process of functional area. B: Audits that assesses the correctness of financial statements is called financial audit. D: They are the IS audits with specific intent to examine areas, such as processes, services, or technologies, usually by third party auditors.

   Source: Adapted from community discussion — Kennethlim79

   Next question

10. Question 730 · 1449 in bank

    Billy is the project manager of the HAR Project and is in month six of the project. The project is scheduled to last for 18 months. Management asks Billy how often the project team is participating in risk reassessment in this project. What should Billy tell management if he's following the best practices for risk management?

    • AProject risk management has been concluded with the project planning.
    • BProject risk management happens at every milestone.
    • CProject risk management is scheduled for every month in the 18-month project.
    • DAt every status meeting the project team project risk management is an agenda item.

    Show answer

    Answer: D

    Explanation

    Risk management is an ongoing project activity. It should be an agenda item at every project status meeting. Incorrect Answers: A: Risk management happens throughout the project as does project planning. B: Milestones are good times to do reviews, but risk management should happen frequently. C: This answer would only be correct if the project has a status meeting just once per month in the project.

    Source: Adapted from community discussion — Promz

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 721. 1449 questions available.