CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 61
1. You are the project manager of a SGT project. You have been actively communicating and working with the project stakeholders. One of the outputs of the'manage stakeholder expectations' process can actually create new risk events for your project. Which output of the manage stakeholder expectations process can create risks?
A) Project management plan updates
B) An organizational process asset updates
C) Change requests
D) Project document updates
2. Which of the following characteristics of risk controls can be defined as under?'The separation of controls in the production environment rather than the separation in the design and implementation of the risk'
A) Trusted source
B) Secure
C) Distinct
D) Independent
3. Shelly is the project manager of the BUF project for her company. In this project Shelly needs to establish some rules to reduce the influence of risk bias during the qualitative risk analysis process. What method can Shelly take to best reduce the influence of risk bias?
A) Establish risk boundaries
B) Group stakeholders according to positive and negative stakeholders and then complete the risk analysis
C) Determine the risk root cause rather than the person identifying the risk events
D) Establish definitions of the level of probability and impact of risk event
4. You are the IT manager in Bluewell Inc. You identify a new regulation for safeguarding the information processed by a specific type of transaction. What would be the FIRST action you will take?
A) Assess whether existing controls meet the regulation
B) Update the existing security privacy policy
C) Meet with stakeholders to decide how to comply
D) Analyze the key risk in the compliance process
5. You are the risk official of your enterprise. You have just completed risk analysis process. You noticed that the risk level associated with your project is less than risk tolerance level of your enterprise. Which of following is the MOST likely action you should take?
A) Apply risk response
B) Update risk register
C) No action
D) Prioritize risk response options
A) Project management plan updates
B) An organizational process asset updates
C) Change requests
D) Project document updates
2. Which of the following characteristics of risk controls can be defined as under?'The separation of controls in the production environment rather than the separation in the design and implementation of the risk'
A) Trusted source
B) Secure
C) Distinct
D) Independent
3. Shelly is the project manager of the BUF project for her company. In this project Shelly needs to establish some rules to reduce the influence of risk bias during the qualitative risk analysis process. What method can Shelly take to best reduce the influence of risk bias?
A) Establish risk boundaries
B) Group stakeholders according to positive and negative stakeholders and then complete the risk analysis
C) Determine the risk root cause rather than the person identifying the risk events
D) Establish definitions of the level of probability and impact of risk event
4. You are the IT manager in Bluewell Inc. You identify a new regulation for safeguarding the information processed by a specific type of transaction. What would be the FIRST action you will take?
A) Assess whether existing controls meet the regulation
B) Update the existing security privacy policy
C) Meet with stakeholders to decide how to comply
D) Analyze the key risk in the compliance process
5. You are the risk official of your enterprise. You have just completed risk analysis process. You noticed that the risk level associated with your project is less than risk tolerance level of your enterprise. Which of following is the MOST likely action you should take?
A) Apply risk response
B) Update risk register
C) No action
D) Prioritize risk response options
1. Right Answer: C
Explanation: The manage stakeholder expectations process can create change requests for the project, which can cause new risk events to enter into the project.Change requests are requests to expand or reduce the project scope, modify policies, processes, plans, or procedures, modify costs or budgets or revise schedules. These requests for a change can be direct or indirect, externally or internally initiated, and legally or contractually imposed or optional. A ProjectManager needs to ensure that only formally documented requested changes are processed and only approved change requests are implemented.Incorrect Answers:A: The project management plan updates do not create new risks.B: The organizational process assets updates do not create new risks.D: The project document updates do not create new risks.
2. Right Answer: C
Explanation: A control or countermeasure which does not overlap in its performance with another control or countermeasure is considered as distinct. Hence the separation of controls in the production environment rather than the separation in the design and implementation of the risk refers to distinct.Incorrect Answers:A: Trusted source refers to the commitment of the people designing, implementing, and maintenance of the control towards the security policy.B: Secure controls refers to the activities ability to protect from exploitation or attack.D: The separation in design, implementation, and maintenance of controls or countermeasures are refer to as independent. Hence this answer is not valid.
3. Right Answer: D
Explanation: By establishing definitions for the level of probability and impact a project manager can reduce the influence of bias.Incorrect Answers:A: This is not a valid statement for reducing bias in the qualitative risk analysis.B: Positive and negative stakeholders are identified based on their position towards the project goals and objectives, not necessarily risks.C: Root cause analysis is a good exercise, but it would not determine risk bias.
4. Right Answer: A
Explanation: When a new regulation for safeguarding information processed by a specific type of transaction is being identified by the IT manager, then the immediate step would be to understand the impact and requirements of this new regulation. This includes assessing how the enterprise will comply with the regulation and to what extent the existing control structure supports the compliance process. After that manager should then assess any existing gaps.Incorrect Answers:B, C, D: These choices are appropriate as well as important, but are subsequent steps after understanding and gap assessment.
5. Right Answer: C
Explanation: When the risk level is less than risk tolerance level of the enterprise than no action is taken against that, because the cost of mitigation will increase over its benefits.Incorrect Answers:A: This is not a valid answer, as no response is being applied to such low risk level.B: Risk register is updates after applying response, and as no response is applied to such low risk level; hence no updating is done.D: This is not a valid answer, as no response is being applied to such low risk level.
Explanation: The manage stakeholder expectations process can create change requests for the project, which can cause new risk events to enter into the project.Change requests are requests to expand or reduce the project scope, modify policies, processes, plans, or procedures, modify costs or budgets or revise schedules. These requests for a change can be direct or indirect, externally or internally initiated, and legally or contractually imposed or optional. A ProjectManager needs to ensure that only formally documented requested changes are processed and only approved change requests are implemented.Incorrect Answers:A: The project management plan updates do not create new risks.B: The organizational process assets updates do not create new risks.D: The project document updates do not create new risks.
2. Right Answer: C
Explanation: A control or countermeasure which does not overlap in its performance with another control or countermeasure is considered as distinct. Hence the separation of controls in the production environment rather than the separation in the design and implementation of the risk refers to distinct.Incorrect Answers:A: Trusted source refers to the commitment of the people designing, implementing, and maintenance of the control towards the security policy.B: Secure controls refers to the activities ability to protect from exploitation or attack.D: The separation in design, implementation, and maintenance of controls or countermeasures are refer to as independent. Hence this answer is not valid.
3. Right Answer: D
Explanation: By establishing definitions for the level of probability and impact a project manager can reduce the influence of bias.Incorrect Answers:A: This is not a valid statement for reducing bias in the qualitative risk analysis.B: Positive and negative stakeholders are identified based on their position towards the project goals and objectives, not necessarily risks.C: Root cause analysis is a good exercise, but it would not determine risk bias.
4. Right Answer: A
Explanation: When a new regulation for safeguarding information processed by a specific type of transaction is being identified by the IT manager, then the immediate step would be to understand the impact and requirements of this new regulation. This includes assessing how the enterprise will comply with the regulation and to what extent the existing control structure supports the compliance process. After that manager should then assess any existing gaps.Incorrect Answers:B, C, D: These choices are appropriate as well as important, but are subsequent steps after understanding and gap assessment.
5. Right Answer: C
Explanation: When the risk level is less than risk tolerance level of the enterprise than no action is taken against that, because the cost of mitigation will increase over its benefits.Incorrect Answers:A: This is not a valid answer, as no response is being applied to such low risk level.B: Risk register is updates after applying response, and as no response is applied to such low risk level; hence no updating is done.D: This is not a valid answer, as no response is being applied to such low risk level.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment