CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 14
1. Which of the following statements is NOT true regarding the risk management plan?
A) The risk management plan is an output of the Plan Risk Management process.
B) The risk management plan is an input to all the remaining risk-planning processes.
C) The risk management plan includes a description of the risk responses and triggers.
D) The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.
2. You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?
A) Project network diagrams
B) Cause-and-effect analysis
C) Decision tree analysis
D) Delphi Technique
3. What is the MAIN purpose of designing risk management programs?
A) To reduce the risk to a level that the enterprise is willing to accept
B) To reduce the risk to the point at which the benefit exceeds the expense
C) To reduce the risk to a level that is too small to be measurable
D) To reduce the risk to a rate of return that equals the current cost of capital
4. Which of the following is the priority of data owners when establishing risk mitigation method?
A) User entitlement changes
B) Platform security
C) Intrusion detection
D) Antivirus controls
5. What type of policy would an organization use to forbid its employees from using organizational e-mail for personal use?
A) Anti-harassment policy
B) Acceptable use policy
C) Intellectual property policy
D) Privacy policy
A) The risk management plan is an output of the Plan Risk Management process.
B) The risk management plan is an input to all the remaining risk-planning processes.
C) The risk management plan includes a description of the risk responses and triggers.
D) The risk management plan includes thresholds, scoring and interpretation methods, responsible parties, and budgets.
2. You are the project manager of a project in Bluewell Inc. You and your project team have identified several project risks, completed risk analysis, and are planning to apply most appropriate risk responses. Which of the following tools would you use to choose the appropriate risk response?
A) Project network diagrams
B) Cause-and-effect analysis
C) Decision tree analysis
D) Delphi Technique
3. What is the MAIN purpose of designing risk management programs?
A) To reduce the risk to a level that the enterprise is willing to accept
B) To reduce the risk to the point at which the benefit exceeds the expense
C) To reduce the risk to a level that is too small to be measurable
D) To reduce the risk to a rate of return that equals the current cost of capital
4. Which of the following is the priority of data owners when establishing risk mitigation method?
A) User entitlement changes
B) Platform security
C) Intrusion detection
D) Antivirus controls
5. What type of policy would an organization use to forbid its employees from using organizational e-mail for personal use?
A) Anti-harassment policy
B) Acceptable use policy
C) Intellectual property policy
D) Privacy policy
1. Right Answer: C
Explanation: The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. The risk management plan does not include responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.Incorrect Answers:A, B, D: These all statements are true for risk management plan. The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. It includes thresholds, scoring and interpretation methods, responsible parties, and budgets. It also act as input to all the remaining risk-planning processes.
2. Right Answer: C
Explanation: Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.Incorrect Answers:A: Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning.B: Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning. This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.D: Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus.
3. Right Answer: A
Explanation: Risk cannot be removed completely from the enterprise; it can only be reduced to a level that an organization is willing to accept. Risk management programs are hence designed to accomplish the task of reducing risks.Incorrect Answers:B: Depending on the risk preference of an enterprise, it may or may not choose to pursue risk mitigation to the point at which benefit equals or exceeds the expense. Hence this is not the primary objective of designing the risk management program.C: Reducing risk to a level too small to measure is not practical and is often cost-prohibitive.D: Reducing risks to a specific return ignores the qualitative aspects of the risk which should also be considered.
4. Right Answer: A
Explanation: Data owners are responsible for assigning user entitlement changes and approving access to the systems for which they are responsible.Incorrect Answers:B, C, D: Data owners are not responsible for intrusion detection, platform security or antivirus controls.These are the responsibilities of data custodians.
5. Right Answer: B
Explanation: An acceptable use policy is a set of rules applied by the owner/manager of a network, website or large computer system that restrict the ways in which the network site or system may be used. Acceptable Use Policies are an integral part of the framework of information security policies.Incorrect Answers:A, C: These two policies are not related to Information system security.D: Privacy policy is a statement or a legal document (privacy law) that discloses some or all of the ways a party gathers, uses, discloses and manages a customer or client's data.
Explanation: The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. The risk management plan does not include responses to risks or triggers. Responses to risks are documented in the risk register as part of the Plan Risk Responses process.Incorrect Answers:A, B, D: These all statements are true for risk management plan. The risk management plan details how risk management processes will be implemented, monitored, and controlled throughout the life of the project. It includes thresholds, scoring and interpretation methods, responsible parties, and budgets. It also act as input to all the remaining risk-planning processes.
2. Right Answer: C
Explanation: Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility.Incorrect Answers:A: Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning.B: Cause-and-effect analysis is used for exposing risk factors and not an effective one in risk response planning. This analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes.D: Delphi technique is used for risk analysis, i.e., for identifying the most probable risks. Delphi is a group of experts who used to rate independently the business risk of an organization. Each expert analyzes the risk independently and then prioritizes the risk, and the result is combined into a consensus.
3. Right Answer: A
Explanation: Risk cannot be removed completely from the enterprise; it can only be reduced to a level that an organization is willing to accept. Risk management programs are hence designed to accomplish the task of reducing risks.Incorrect Answers:B: Depending on the risk preference of an enterprise, it may or may not choose to pursue risk mitigation to the point at which benefit equals or exceeds the expense. Hence this is not the primary objective of designing the risk management program.C: Reducing risk to a level too small to measure is not practical and is often cost-prohibitive.D: Reducing risks to a specific return ignores the qualitative aspects of the risk which should also be considered.
4. Right Answer: A
Explanation: Data owners are responsible for assigning user entitlement changes and approving access to the systems for which they are responsible.Incorrect Answers:B, C, D: Data owners are not responsible for intrusion detection, platform security or antivirus controls.These are the responsibilities of data custodians.
5. Right Answer: B
Explanation: An acceptable use policy is a set of rules applied by the owner/manager of a network, website or large computer system that restrict the ways in which the network site or system may be used. Acceptable Use Policies are an integral part of the framework of information security policies.Incorrect Answers:A, C: These two policies are not related to Information system security.D: Privacy policy is a statement or a legal document (privacy law) that discloses some or all of the ways a party gathers, uses, discloses and manages a customer or client's data.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment