CRISC practice questions 791–800

1. Question 791 · 1449 in bank

   Select 3

   What are the functions of the auditor while analyzing risk? Each correct answer represents a complete solution. (Choose three.)

   • AAids in determining audit objectives
   • BIdentify threats and vulnerabilities to the information system
   • CProvide information for evaluation of controls in audit planning
   • DSupporting decision based on risks

   Show answer

   Answer: ABC

   Explanation

   A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of: ✑ Threats to various processes of organization. ✑ Threats to physical and information assets. ✑ Likelihood and frequency of occurrence from threat. ✑ Impact on assets from threat and vulnerability. ✑ Risk analysis allows the auditor to do the following tasks : ✑ Threats to various processes of organization. ✑ Threats to physical and information assets. ✑ Likelihood and frequency of occurrence from threat. ✑ Impact on assets from threat and vulnerability. ✑ Risk analysis allows the auditor to do the following tasks : ✑ Identify threats and vulnerabilities to the enterprise and its information system. ✑ Provide information for evaluation of controls in audit planning. ✑ Aids in determining audit objectives. ✑ Supporting decision based on risks. Incorrect Answers: B: Auditors identify threats and vulnerability not only in the IT but the whole enterprise as well.

   Source: Adapted from community discussion — Kennethlim79

   Next question

2. Question 792 · 1449 in bank

   Select 2

   What are the key control activities to be done to ensure business alignment? Each correct answer represents a part of the solution. (Choose two.)

   • ADefine the business requirements for the management of data by IT
   • BConduct IT continuity tests on a regular basis or when there are major changes in the IT infrastructure
   • CPeriodically identify critical data that affect business operations
   • DEstablish an independent test task force that keeps track of all events

   Show answer

   Answer: AC

   Explanation

   Business alignment require following control activities: ✑ Defining the business requirements for the management of data by IT. ✑ Periodically identifying critical data that affect business operations, in alignment with the risk management model and IT service as well as the business continuity plan. Incorrect Answers: B: Conducting IT continuity tests on a regular basis or when there are major changes in the IT infrastructure is done for testing IT continuity plan. It does not ensure alignment with business. D: This is not a valid answer.

   Source: Adapted from community discussion — Kennethlim79

   Next question

3. Question 793 · 1449 in bank

   Which of the following statements is true for risk analysis?

   • ARisk analysis should assume an equal degree of protection for all assets.
   • BRisk analysis should give more weight to the likelihood than the size of loss.
   • CRisk analysis should limit the scope to a benchmark of similar companies
   • DRisk analysis should address the potential size and likelihood of loss.

   Show answer

   Answer: D

   Explanation

   A risk analysis deals with the potential size and likelihood of loss. A risk analysis involves identifying the most probable threats to an organization and analyzing the related vulnerabilities of the organization to these threats. A risk from an organizational perspective consists of: ✑ Threats to various processes of organization. ✑ Threats to physical and information assets. Likelihood and frequency of occurrence from threat. ✑ Impact on assets from threat and vulnerability. ✑ Risk analysis allows the auditor to do the following tasks : ✑ Identify threats and vulnerabilities to the enterprise and its information system. ✑ Provide information for evaluation of controls in audit planning. ✑ Aids in determining audit objectives. ✑ Supporting decision based on risks. Incorrect Answers: A: Assuming equal degree of protection would only be rational in the rare event that all the assets are similar in sensitivity and criticality. Hence this is not practiced in risk analysis. B: Since the likelihood determines the size of the loss, hence both elements must be considered in the calculation. C: A risk analysis would not normally consider the benchmark of similar companies as providing relevant information other than for comparison purposes.

   

   Next question

4. Question 794 · 1449 in bank

   You are the project manager of the NNN Project. Stakeholders in the two-year project have requested to send status reports to them via. email every week. You have agreed and send reports every Thursday. After six months of the project, the stakeholders are pleased with the project progress and they would like you to reduce the status reports to every two weeks. What process will examine the change to this project process and implement it in the project?

   • AConfiguration management
   • BCommunications management
   • CPerform integrated change control process
   • DProject change control process

   Show answer

   Answer: C

   Explanation

   Although this appears to be a simple change the project manager must still follow the rules of the project's change control system. Integrated change control is a way to manage the changes incurred during a project. It is a method that manages reviewing the suggestions for changes and utilizing the tools and techniques to evaluate whether the change should be approved or rejected. Integrated change control is a primary component of the project's change control system that examines the affect of a proposed change on the entire project. Incorrect Answers: A: Configuration management is the documentation and control of the product's features and functions. B: Communications management is the execution of the communications management plan. D: The project change control process not valid as it's the parent of the integrated change control process, which is more accurate for this question.

   Source: Adapted from community discussion — cut_xcloud9

   Next question

5. Question 795 · 1449 in bank

   You are the project manager of your enterprise. You have identified several risks. Which of the following responses to risk is considered the MOST appropriate?

   • AAny of the above
   • BInsuring
   • CAvoiding
   • DAccepting

   Show answer

   Answer: A

   Explanation

   The appropriate response to the risk is decided by the risk itself, the company's attitude and appetite of risk, and the threat and opportunity combination of the risk. Incorrect Answers: B, C, D: Depending upon the condition, that is, the risk itself, the company's attitude and appetite of risk, and the threat and opportunity combination of the risk, these response options can be chosen.

   Next question

6. Question 796 · 1449 in bank

   You work as a project manager for BlueWell Inc. You are preparing for the risk identification process. You will need to involve several of the project's key stakeholders to help you identify and communicate the identified risk events. You will also need several documents to help you and the stakeholders identify the risk events. Which one of the following is NOT a document that will help you identify and communicate risks within the project?

   • AStakeholder registers
   • BActivity duration estimates
   • CActivity cost estimates
   • DRisk register

   Show answer

   Answer: D

   Explanation

   Risk register is not an input to risk identification, but it is an output of risk identification. Incorrect Answers: A, B, C: These are an input to risk identification. Identify Risks is the process of determining which risks may affect the project. It also documents risks' characteristics. The Identify Risks process is part of the Project Risk Management knowledge area. As new risks may evolve or become known as the project progresses through its life cycle, Identify Risks is an iterative process. The process should involve the project team so that they can develop and maintain a sense of ownership and responsibility for the risks and associated risk response actions. Risk Register is the only output of this process.

   Next question

7. Question 797 · 1449 in bank

   Which of the following is the MOST important aspect to ensure that an accurate risk register is maintained?

   • APublish the risk register in a knowledge management platform with workflow features that periodically contacts and polls risk assessors to ensure accuracy of content
   • BPerform regular audits by audit personnel and maintain risk register
   • CSubmit the risk register to business process owners for review and updating
   • DMonitor key risk indicators, and record the findings in the risk register

   Show answer

   Answer: A

   Explanation

   A knowledge management platform with workflow and polling feature will automate the process of maintaining the risk registers. Hence this ensures that an accurate and updated risk register is maintained. Incorrect Answers: B: Audit personnel may not have the appropriate business knowledge in risk assessment, hence cannot properly identify risk. Regular audits may also cause hindrance to the business activities. C: Business process owners typically cannot effectively identify risk to their business processes. They may not have the ability to be unbiased and may not have the appropriate skills or tools for evaluating risks. D: Monitoring key risk indicators, and record the findings in the risk register will only provide insights to known and identified risk and will not account for obscure risk, i.e. , risk that has not been identified yet.

   Next question

8. Question 798 · 1449 in bank

   Select 3

   You are the project manager of GHT project. A risk event has occurred in your project and you have identified it. Which of the following tasks you would do in reaction to risk event occurrence? Each correct answer represents a part of the solution. (Choose three.)

   • AMonitor risk
   • BMaintain and initiate incident response plans
   • CUpdate risk register
   • DCommunicate lessons learned from risk events

   Show answer

   Answer: ABC

   Explanation

   When the risk events occur then following tasks have to done to react to it: ✑ Maintain incident response plans ✑ Monitor risk ✑ Initiate incident response ✑ Communicate lessons learned from risk events Incorrect Answers: C: Risk register is updated after applying appropriate risk response and at the time of risk event occurrence.

   Next question

9. Question 799 · 1449 in bank

   Select 3

   Which of the following parameters are considered for the selection of risk indicators? Each correct answer represents a part of the solution. (Choose three.)

   • ASize and complexity of the enterprise
   • BType of market in which the enterprise operates
   • CRisk appetite and risk tolerance
   • DStrategy focus of the enterprise

   Show answer

   Answer: ACD

   Explanation

   Risk indicators are placed at control points within the enterprise and are used to collect data. These collected data are used to measure the risk levels at that point. They also track events or incidents that may indicate a potentially harmful situation. Risk indicators can be in form of logs, alarms and reports. Risk indicators are selected depending on a number of parameters in the internal and external environment, such as: ✑ Size and complexity of the enterprise ✑ Type of market in which the enterprise operates ✑ Strategy focus of the enterprise Incorrect Answers: C: Risk appetite and risk tolerance are considered when applying various risk responses.

   Next question

10. Question 800 · 1449 in bank

    You are the project manager of GHT project. Your project utilizes a machine for production of goods. This machine has the specification that if its temperature would rise above 450 degree Fahrenheit then it may result in burning of windings. So, there is an alarm which blows when machine's temperature reaches 430 degree Fahrenheit and the machine is shut off for 1 hour. What role does alarm contribute here?

    • AOf risk indicator
    • BOf risk identification
    • COf risk trigger
    • DOf risk response

    Show answer

    Answer: C

    Explanation

    Here in this scenario alarm indicates the potential risk that the rising temperature of machine can cause, hence it is enacting as a risk indicator. Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks. Incorrect Answers: B: The first thing we must do in risk management is to identify the areas of the project where the risks can occur. This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them. C: The temperature 430 degrees in scenario is the risk trigger. A risk trigger is a warning sign or condition that a risk event is about to happen. As in this scenario the 430-degree temperature is the indication of upcoming risks, hence 430 degree temperature is a risk trigger. D: Risk response is the action taken to reduce the risk event occurrence. Hence here risk response is shutting off of machine.

    Source: Adapted from community discussion — Rooks

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

CRISC practice, question 791. 1449 questions available.