CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 69
1. Which of the following statements are true for risk communication? Each correct answer represents a complete solution. Choose three.(Select 3answers)
A) It requires a practical and deliberate scheduling approach to identify stakeholders, actions, and concerns.
B) It helps in allocating the information concerning risk among the decision-makers.
C) It requires investigation and interconnectivity of procedural, legal, social, political, and economic factors.
D) It defines the issue of what a stakeholders does, not just what it says.
2. Which of the following is the most accurate definition of a project risk?
A) It is an unknown event that can affect the project scope.
B) It is an uncertain event or condition within the project execution.
C) It is an uncertain event that can affect the project costs.
D) It is an uncertain event that can affect at least one project objective.
3. Which of the following considerations should be taken into account while selecting risk indicators that ensures greater buy-in and ownership?
A) Lag indicator
B) Lead indicator
C) Root cause
D) Stakeholder
4. Suppose you are working in Techmart Inc. which sells various products through its website. Due to some recent losses, you are trying to identify the most important risks to the Website. Based on feedback from several experts, you have come up with a list. You now want to prioritize these risks. Now in which category you would put the risk concerning the modification of the Website by unauthorized parties.
A) Ping Flooding Attack
B) Web defacing
C) Denial of service attack
D) FTP Bounce Attack
5. Which of the following is true for risk evaluation?
A) Risk evaluation is done only when there is significant change.
B) Risk evaluation is done once a year for every business processes.
C) Risk evaluation is done annually or when there is significant change.
D) Risk evaluation is done every four to six months for critical business processes.
A) It requires a practical and deliberate scheduling approach to identify stakeholders, actions, and concerns.
B) It helps in allocating the information concerning risk among the decision-makers.
C) It requires investigation and interconnectivity of procedural, legal, social, political, and economic factors.
D) It defines the issue of what a stakeholders does, not just what it says.
2. Which of the following is the most accurate definition of a project risk?
A) It is an unknown event that can affect the project scope.
B) It is an uncertain event or condition within the project execution.
C) It is an uncertain event that can affect the project costs.
D) It is an uncertain event that can affect at least one project objective.
3. Which of the following considerations should be taken into account while selecting risk indicators that ensures greater buy-in and ownership?
A) Lag indicator
B) Lead indicator
C) Root cause
D) Stakeholder
4. Suppose you are working in Techmart Inc. which sells various products through its website. Due to some recent losses, you are trying to identify the most important risks to the Website. Based on feedback from several experts, you have come up with a list. You now want to prioritize these risks. Now in which category you would put the risk concerning the modification of the Website by unauthorized parties.
A) Ping Flooding Attack
B) Web defacing
C) Denial of service attack
D) FTP Bounce Attack
5. Which of the following is true for risk evaluation?
A) Risk evaluation is done only when there is significant change.
B) Risk evaluation is done once a year for every business processes.
C) Risk evaluation is done annually or when there is significant change.
D) Risk evaluation is done every four to six months for critical business processes.
1. Right Answer: A,C,D
Explanation: Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders.Risk communication can be explained more clearly with the help of the following definitions: It defines the issue of what a group does, not just what it says. It must take into account the valuable element in user's perceptions of risk. It will be more valuable if it is thought of as conversation, not instruction.Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.Incorrect Answers:B: It helps in allocating the information concerning risk not only among the decision-makers but also stakeholders.
2. Right Answer: D
Explanation: Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective.Project risk is concerned with the expected value of one or more results of one or more future events in a project. It is an uncertain condition that, if it occurs, has an effect on at least one project objective. Objectives can be scope, schedule, cost, and quality. Project risk is always in the future.Incorrect Answers:A: Risk is not unknown, it is uncertain; in addition, the event can affect at least one project objective - not just the project scope.B: This statement is almost true, but the event does not have to happen within project execution.C: Risks can affect time, costs, or scope, rather affecting only cost.
3. Right Answer: D
Explanation: To ensure greater buy-in and ownership, risk indicators should be selected with the involvement of relevant stakeholders. Risk indicators should be identified for all stakeholders and should not focus solely on the more operational or strategic side of risk.Incorrect Answers:A: Role of lag indicators is to ensure that risk after events have occurred is being indicated.B: Lead indicators indicate which capabilities are in place to prevent events from occurring. They do not play any role in ensuring greater buy-in and ownership.C: Root cause is considered while selecting risk indicator but it does not ensure greater buy-in or ownership.
4. Right Answer: B
Explanation: Website defacing is an attack on a website by unauthorized party that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.Incorrect Answers:A: Ping Flooding is the extreme of sending thousands or millions of pings per second. Ping Flooding attack can make system slow or even shut down an entire site.C: A denial-of-service attack (DoS attack) is an attempt to make a computer or network resource unavailable to its intended users. One common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable.D: The FTP bounce attack is attack which slips past application-based firewalls. In this hacker uploads a file to the FTP server and then requests this file be sent to an internal server. This file may contain malicious software or a simple script that occupies the internal server and uses up all the memory and CPU resources.
5. Right Answer: C
Explanation: Due to the reason that risk is constantly changing, it is being evaluated annually or when there is significant change. This gives best alternative as it takes into consideration a reasonable time frame of one year, and meanwhile it also addresses significant changes (if any).Incorrect Answers:A: Evaluating risk only when there is significant changes do not take into consideration the effect of time. As the risk is changing constantly, small changes do occur with time that would affect the overall risk. Hence risk evaluation should be done annually too.B: Evaluating risk once a year is not sufficient in the case when some significant change takes place. This significant change should be taken into account as it affects the overall risk.D: Risk evaluation need not to be done every four to six months for critical processes, as it does not addresses important changes in timely manner.
Explanation: Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders.Risk communication can be explained more clearly with the help of the following definitions: It defines the issue of what a group does, not just what it says. It must take into account the valuable element in user's perceptions of risk. It will be more valuable if it is thought of as conversation, not instruction.Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.Incorrect Answers:B: It helps in allocating the information concerning risk not only among the decision-makers but also stakeholders.
2. Right Answer: D
Explanation: Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective.Project risk is concerned with the expected value of one or more results of one or more future events in a project. It is an uncertain condition that, if it occurs, has an effect on at least one project objective. Objectives can be scope, schedule, cost, and quality. Project risk is always in the future.Incorrect Answers:A: Risk is not unknown, it is uncertain; in addition, the event can affect at least one project objective - not just the project scope.B: This statement is almost true, but the event does not have to happen within project execution.C: Risks can affect time, costs, or scope, rather affecting only cost.
3. Right Answer: D
Explanation: To ensure greater buy-in and ownership, risk indicators should be selected with the involvement of relevant stakeholders. Risk indicators should be identified for all stakeholders and should not focus solely on the more operational or strategic side of risk.Incorrect Answers:A: Role of lag indicators is to ensure that risk after events have occurred is being indicated.B: Lead indicators indicate which capabilities are in place to prevent events from occurring. They do not play any role in ensuring greater buy-in and ownership.C: Root cause is considered while selecting risk indicator but it does not ensure greater buy-in or ownership.
4. Right Answer: B
Explanation: Website defacing is an attack on a website by unauthorized party that changes the visual appearance of the site or a webpage. These are typically the work of system crackers, who break into a web server and replace the hosted website with one of their own.Incorrect Answers:A: Ping Flooding is the extreme of sending thousands or millions of pings per second. Ping Flooding attack can make system slow or even shut down an entire site.C: A denial-of-service attack (DoS attack) is an attempt to make a computer or network resource unavailable to its intended users. One common method of attack involves saturating the target machine with external communications requests, such that it cannot respond to legitimate traffic, or responds so slowly as to be rendered effectively unavailable.D: The FTP bounce attack is attack which slips past application-based firewalls. In this hacker uploads a file to the FTP server and then requests this file be sent to an internal server. This file may contain malicious software or a simple script that occupies the internal server and uses up all the memory and CPU resources.
5. Right Answer: C
Explanation: Due to the reason that risk is constantly changing, it is being evaluated annually or when there is significant change. This gives best alternative as it takes into consideration a reasonable time frame of one year, and meanwhile it also addresses significant changes (if any).Incorrect Answers:A: Evaluating risk only when there is significant changes do not take into consideration the effect of time. As the risk is changing constantly, small changes do occur with time that would affect the overall risk. Hence risk evaluation should be done annually too.B: Evaluating risk once a year is not sufficient in the case when some significant change takes place. This significant change should be taken into account as it affects the overall risk.D: Risk evaluation need not to be done every four to six months for critical processes, as it does not addresses important changes in timely manner.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment