CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 55
1. You are the project manager of GHT project. You are performing cost and benefit analysis of control. You come across the result that costs of specific controls exceed the benefits of mitigating a given risk. What is the BEST action would you choose in this scenario?
A) The enterprise may apply the appropriate control anyway.
B) The enterprise should adopt corrective control.
C) The enterprise may choose to accept the risk rather than incur the cost of mitigation.
D) The enterprise should exploit the risk.
2. Mortality tables are based on what mathematical activity?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Normal distributions
B) Probabilities
C) Impact
D) Sampling
3. Harry is the project manager of HDW project. He has identified a risk that could injure project team members. He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?
A) Transference
B) Mitigation
C) Acceptance
D) Avoidance
4. The Identify Risk process determines the risks that affect the project and document their characteristics. Why should the project team members be involved in theIdentify Risk process?
A) They are the individuals that will most likely cause and respond to the risk events.
B) They are the individuals that will have the best responses for identified risks events within the project.
C) They are the individuals that are most affected by the risk events.
D) They are the individuals that will need a sense of ownership and responsibility for the risk events.
5. What are the requirements of monitoring risk?Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Information of various stakeholders
B) Preparation of detailed monitoring plan
C) Identifying the risk to be monitored
D) Defining the project's scope
A) The enterprise may apply the appropriate control anyway.
B) The enterprise should adopt corrective control.
C) The enterprise may choose to accept the risk rather than incur the cost of mitigation.
D) The enterprise should exploit the risk.
2. Mortality tables are based on what mathematical activity?Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) Normal distributions
B) Probabilities
C) Impact
D) Sampling
3. Harry is the project manager of HDW project. He has identified a risk that could injure project team members. He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?
A) Transference
B) Mitigation
C) Acceptance
D) Avoidance
4. The Identify Risk process determines the risks that affect the project and document their characteristics. Why should the project team members be involved in theIdentify Risk process?
A) They are the individuals that will most likely cause and respond to the risk events.
B) They are the individuals that will have the best responses for identified risks events within the project.
C) They are the individuals that are most affected by the risk events.
D) They are the individuals that will need a sense of ownership and responsibility for the risk events.
5. What are the requirements of monitoring risk?Each correct answer represents a part of the solution. Choose three.(Select 3answers)
A) Information of various stakeholders
B) Preparation of detailed monitoring plan
C) Identifying the risk to be monitored
D) Defining the project's scope
1. Right Answer: C
Explanation: If the costs of specific controls or countermeasures (control overhead) exceed the benefits of mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of mitigation. This is done according to the principle of proportionality described in: Generally accepted security systems principles (GASSP) Generally accepted information security principles (GAISP)Incorrect Answers:A: When the cost of specific controls exceed the benefits of mitigating a given risk, then controls are not applied, rather risk is being accepted.B: As the cost of control exceeds the benefits of mitigating a given risk, hence no control should be applied.Corrective control is a type of control and hence it should not be adopted.D: The risk is being exploited when there is an opportunity, i.e., the risk is positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot be done.
2. Right Answer: A,B,D
Explanation: Probability identifies the chances that a particular event will happen under certain circumstances.The variables provided are based on information gathered in real life. For situations with large numbers, a smaller set of participants are identified to represent the larger population. This represents a sample of the population. The points are mapped to identify their distribution.Normal distribution refers to the theoretical plotting of points against the mathematical mean.The result of these activities provides a reasonable predictability for the mortality of the subject.Incorrect Answers:C: Impact is used to identify the magnitude of identified risks. The risk leads to some type of loss. However, instead of quantifying the loss as a dollar value, an impact assessment could use words such as Low, Medium, or High. Hence it is not mathematical.
3. Right Answer: A
Explanation: Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity.Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer. Hence when Harry hires a professional vendor to manage that risk, the risk event does not go away but the responsibility for the event is transferred to the vendor.Incorrect Answers:B: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. Here Harry is not accepting this risk event; he does not want anyone of his team to become injured so he's transferring the event to professional vendor.C: Mitigation are actions that Harry's project team could take to reduce the probability and/or impact of a risk event.D: Avoidance removes the risk event entirely either by adding additional steps to avoid the event or reducing the project scope.
4. Right Answer: D
Explanation: The project team members should be involved in the risk identification so that they will develop a sense of ownership and responsibility for the risk events and the associated risk responses.Identify Risks is the process of determining which risks may affect the project. It also documents risks' characteristics. The Identify Risks process is part of theProject Risk Management knowledge area. As new risks may evolve or become known as the project progresses through its life cycle, Identify Risks is an iterative process. The process should involve the project team so that they can develop and maintain a sense of ownership and responsibility for the risks and associated risk response actions. Risk Register is the only output of this process.Incorrect Answers:A, B, C: These are not the valid answers for this question.
5. Right Answer: B,C,D
Explanation: It is important to first understand the risk to be monitored, prepare a detailed plan and define the project's scope for monitoring risk. In the case of a monitoring project, this step should involve process owners, data owners, system custodians and other process stakeholders.Incorrect Answers:A: Data regarding stakeholders of the project is not required in any phase of risk monitoring.
Explanation: If the costs of specific controls or countermeasures (control overhead) exceed the benefits of mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of mitigation. This is done according to the principle of proportionality described in: Generally accepted security systems principles (GASSP) Generally accepted information security principles (GAISP)Incorrect Answers:A: When the cost of specific controls exceed the benefits of mitigating a given risk, then controls are not applied, rather risk is being accepted.B: As the cost of control exceeds the benefits of mitigating a given risk, hence no control should be applied.Corrective control is a type of control and hence it should not be adopted.D: The risk is being exploited when there is an opportunity, i.e., the risk is positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot be done.
2. Right Answer: A,B,D
Explanation: Probability identifies the chances that a particular event will happen under certain circumstances.The variables provided are based on information gathered in real life. For situations with large numbers, a smaller set of participants are identified to represent the larger population. This represents a sample of the population. The points are mapped to identify their distribution.Normal distribution refers to the theoretical plotting of points against the mathematical mean.The result of these activities provides a reasonable predictability for the mortality of the subject.Incorrect Answers:C: Impact is used to identify the magnitude of identified risks. The risk leads to some type of loss. However, instead of quantifying the loss as a dollar value, an impact assessment could use words such as Low, Medium, or High. Hence it is not mathematical.
3. Right Answer: A
Explanation: Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity.Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer. Hence when Harry hires a professional vendor to manage that risk, the risk event does not go away but the responsibility for the event is transferred to the vendor.Incorrect Answers:B: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. Here Harry is not accepting this risk event; he does not want anyone of his team to become injured so he's transferring the event to professional vendor.C: Mitigation are actions that Harry's project team could take to reduce the probability and/or impact of a risk event.D: Avoidance removes the risk event entirely either by adding additional steps to avoid the event or reducing the project scope.
4. Right Answer: D
Explanation: The project team members should be involved in the risk identification so that they will develop a sense of ownership and responsibility for the risk events and the associated risk responses.Identify Risks is the process of determining which risks may affect the project. It also documents risks' characteristics. The Identify Risks process is part of theProject Risk Management knowledge area. As new risks may evolve or become known as the project progresses through its life cycle, Identify Risks is an iterative process. The process should involve the project team so that they can develop and maintain a sense of ownership and responsibility for the risks and associated risk response actions. Risk Register is the only output of this process.Incorrect Answers:A, B, C: These are not the valid answers for this question.
5. Right Answer: B,C,D
Explanation: It is important to first understand the risk to be monitored, prepare a detailed plan and define the project's scope for monitoring risk. In the case of a monitoring project, this step should involve process owners, data owners, system custodians and other process stakeholders.Incorrect Answers:A: Data regarding stakeholders of the project is not required in any phase of risk monitoring.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment