CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 1
2. To which level the risk should be reduced to accomplish the objective of risk management?
A) To a level where ALE is lower than SLE
B) To a level where ARO equals SLE
C) To a level that an organization can accept
D) To a level that an organization can mitigate
3. You are the project manager of GHT project. Your hardware vendor left you a voicemail saying that the delivery of the equipment you have ordered would not arrive on time. You identified a risk response strategy for this risk and have arranged for a local company to lease you the needed equipment until yours arrives.This is an example of which risk response strategy?
A) Avoid
B) Transfer
C) Acceptance
D) Mitigate
4. Who is at the BEST authority to develop the priorities and identify what risks and impacts would occur if there were loss of the organization's private information?
A) External regulatory agencies
B) Internal auditor
C) Business process owners
D) Security management
5. You are the project manager for TTP project. You are in the Identify Risks process. You have to create the risk register. Which of the following are included in the risk register?Each correct answer represents a complete solution. Choose two.(Select 2answers)
A) List of potential responses
B) List of key stakeholders
C) List of mitigation techniques
D) List of identified risks
A) To a level where ALE is lower than SLE
B) To a level where ARO equals SLE
C) To a level that an organization can accept
D) To a level that an organization can mitigate
3. You are the project manager of GHT project. Your hardware vendor left you a voicemail saying that the delivery of the equipment you have ordered would not arrive on time. You identified a risk response strategy for this risk and have arranged for a local company to lease you the needed equipment until yours arrives.This is an example of which risk response strategy?
A) Avoid
B) Transfer
C) Acceptance
D) Mitigate
4. Who is at the BEST authority to develop the priorities and identify what risks and impacts would occur if there were loss of the organization's private information?
A) External regulatory agencies
B) Internal auditor
C) Business process owners
D) Security management
5. You are the project manager for TTP project. You are in the Identify Risks process. You have to create the risk register. Which of the following are included in the risk register?Each correct answer represents a complete solution. Choose two.(Select 2answers)
A) List of potential responses
B) List of key stakeholders
C) List of mitigation techniques
D) List of identified risks
2. Right Answer: C
Explanation: The main objective of risk management is to reduce risk to a level that the organization or company will accept, as the risk can never be completely eliminated.Incorrect Answers:A, B: There are no such concepts existing in manipulating risk level.D: Risk mitigation involves identification, planning, and conduct of actions for reducing risk. Because the elimination of all risk is usually impractical or close to impossible, it is aimed at reducing risk to an acceptable level with minimal adverse impact on the organization's resources and mission.
3. Right Answer: D
Explanation: Mitigation attempts to reduce the impact of a risk event in case it occurs. Making plans to arrange for the leased equipment reduces the consequences of the risk and hence this response in mitigation.B: Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.Here there no such action is taken, hence it is not a risk transfer.Incorrect Answers:A: Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event. Risk avoidance is applied when the level of risk, even after the applying controls, would be greater than the risk tolerance level of the enterprise. Hence this risk response is adopted when: There is no other cost-effective response that can successfully reduce the likelihood and magnitude below the defined thresholds for risk appetite.The risk cannot be shared or transferred. The risk is deemed unacceptable by management.C: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active. Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk. Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks.
4. Right Answer: C
Explanation: Business process owners are in best position to judge the risks and impact, as they are most knowledgeable concerning their systems. Hence they are most suitable for developing and identifying risks on business.Incorrect Answers:A, B, D: Internal auditors, security managers, external regulators would not understand the impact on business to the extent that business owners could. Hence business owner is the best authority.
5. Right Answer: A,D
Explanation: Risk register primarily contains the following: List of identified risks: A reasonable description of the identified risks is noted in the risk register. The description includes event, cause, effect, impact related to the risks identified. In addition to the list of identified risks, the root causes of those risks may appear in the risk register. List of potential responses: Potential responses to a risk may be identified during the Identify Risks process. These responses are useful as inputs to the PlanRisk Responses process.Incorrect Answers:B: This is not a valid content of risk register.A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.C: Risk register do contain the summary of mitigation, but only after the applying risk response. Here in this scenario you are in risk identification phase, hence mitigation techniques cannot be documented at this situation.
Explanation: The main objective of risk management is to reduce risk to a level that the organization or company will accept, as the risk can never be completely eliminated.Incorrect Answers:A, B: There are no such concepts existing in manipulating risk level.D: Risk mitigation involves identification, planning, and conduct of actions for reducing risk. Because the elimination of all risk is usually impractical or close to impossible, it is aimed at reducing risk to an acceptable level with minimal adverse impact on the organization's resources and mission.
3. Right Answer: D
Explanation: Mitigation attempts to reduce the impact of a risk event in case it occurs. Making plans to arrange for the leased equipment reduces the consequences of the risk and hence this response in mitigation.B: Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer.Here there no such action is taken, hence it is not a risk transfer.Incorrect Answers:A: Risk avoidance means to evade risk altogether, eliminate the cause of the risk event, or change the project plan to protect the project objectives from the risk event. Risk avoidance is applied when the level of risk, even after the applying controls, would be greater than the risk tolerance level of the enterprise. Hence this risk response is adopted when: There is no other cost-effective response that can successfully reduce the likelihood and magnitude below the defined thresholds for risk appetite.The risk cannot be shared or transferred. The risk is deemed unacceptable by management.C: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. If an enterprise adopts a risk acceptance, it should carefully consider who can accept the risk. Risk should be accepted only by senior management in relationship with senior management and the board. There are two alternatives to the acceptance strategy, passive and active. Passive acceptance means that enterprise has made no plan to avoid or mitigate the risk but willing to accept the consequences of the risk. Active acceptance is the second strategy and might include developing contingency plans and reserves to deal with risks.
4. Right Answer: C
Explanation: Business process owners are in best position to judge the risks and impact, as they are most knowledgeable concerning their systems. Hence they are most suitable for developing and identifying risks on business.Incorrect Answers:A, B, D: Internal auditors, security managers, external regulators would not understand the impact on business to the extent that business owners could. Hence business owner is the best authority.
5. Right Answer: A,D
Explanation: Risk register primarily contains the following: List of identified risks: A reasonable description of the identified risks is noted in the risk register. The description includes event, cause, effect, impact related to the risks identified. In addition to the list of identified risks, the root causes of those risks may appear in the risk register. List of potential responses: Potential responses to a risk may be identified during the Identify Risks process. These responses are useful as inputs to the PlanRisk Responses process.Incorrect Answers:B: This is not a valid content of risk register.A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains: A description of the risk The impact should this event actually occur The probability of its occurrence Risk Score (the multiplication of Probability and Impact) A summary of the planned response should the event occur A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event) Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.C: Risk register do contain the summary of mitigation, but only after the applying risk response. Here in this scenario you are in risk identification phase, hence mitigation techniques cannot be documented at this situation.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment