CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 72
1. You are the project manager of GHT project. You have implemented an automated tool to analyze and report on access control logs based on severity. This tool generates excessively large amounts of results. You perform a risk assessment and decide to configure the monitoring tool to report only when the alerts are marked 'critical'. What you should do in order to fulfill that?
A) Apply risk response
B) Optimize Key Risk Indicator
C) Update risk register
D) Perform quantitative risk analysis
2. One of the risk events you've identified is classified as force majeure. What risk response is likely to be used?
A) Acceptance
B) Transference
C) Enhance
D) Mitigation
3. You are the project manager of GHT project. You have applied certain control to prevent the unauthorized changes in your project. Which of the following control you would have applied for this purpose?
A) Personnel security control
B) Access control
C) Configuration management control
D) Physical and environment protection control
4. You are the project manager for BlueWell Inc. You have noticed that the risk level in your project increases above the risk tolerance level of your enterprise. You have applied several risk response. Now you have to update the risk register in accordance to risk response process. All of the following are included in the risk register except for which item?
A) Risk triggers
B) Agreed-upon response strategies
C) Network diagram analysis of critical path activities
D) Risk owners and their responsibility
5. Ben is the project manager of the CMH Project for his organization. He has identified a risk that has a low probability of happening, but the impact of the risk event could save the project and the organization with a significant amount of capital. Ben assigns Laura to the risk event and instructs her to research the time, cost, and method to improve the probability of the positive risk event. Ben then communicates the risk event and response to management. What risk response has been used here?
A) Transference
B) Enhance
C) Exploit
D) Sharing
A) Apply risk response
B) Optimize Key Risk Indicator
C) Update risk register
D) Perform quantitative risk analysis
2. One of the risk events you've identified is classified as force majeure. What risk response is likely to be used?
A) Acceptance
B) Transference
C) Enhance
D) Mitigation
3. You are the project manager of GHT project. You have applied certain control to prevent the unauthorized changes in your project. Which of the following control you would have applied for this purpose?
A) Personnel security control
B) Access control
C) Configuration management control
D) Physical and environment protection control
4. You are the project manager for BlueWell Inc. You have noticed that the risk level in your project increases above the risk tolerance level of your enterprise. You have applied several risk response. Now you have to update the risk register in accordance to risk response process. All of the following are included in the risk register except for which item?
A) Risk triggers
B) Agreed-upon response strategies
C) Network diagram analysis of critical path activities
D) Risk owners and their responsibility
5. Ben is the project manager of the CMH Project for his organization. He has identified a risk that has a low probability of happening, but the impact of the risk event could save the project and the organization with a significant amount of capital. Ben assigns Laura to the risk event and instructs her to research the time, cost, and method to improve the probability of the positive risk event. Ben then communicates the risk event and response to management. What risk response has been used here?
A) Transference
B) Enhance
C) Exploit
D) Sharing
1. Right Answer: B
Explanation: As the sensitivity of the monitoring tool has to be changed, therefore it requires optimization of Key Risk Indicator. The monitoring tool which is giving alerts is itself acting as a risk indicator. Hence to change the sensitivity of the monitoring tool to give alert only for critical situations requires optimization of the KRI.Incorrect Answers:A, C, D: These options are not relevant to the change of sensitivity of the monitoring tools.
2. Right Answer: A
Explanation: Force majeure describes acts of God (Natural disaster), such as tornados and fires, and are usually accepted because there's little than can be done to mitigate these risks.Incorrect Answers:B: Transference transfers the risk ownership to a third party, usually for a fee.C: Enhance is used for a positive risk event, not for force majeure.D: Mitigation isn't the best choice, as this lowers the probability and/or impact of the risk event.
3. Right Answer: C
Explanation: Configuration management control is a family of controls that addresses both configuration management and change management. Change control practices prevent unauthorized changes. They include goals such as configuring systems for least functionality as a primary method of hardening systems.Incorrect Answers:A: The Personal security control is family of controls that includes aspects of personnel security. It includes personnel screening, termination, and transfer.B: Access control is the family of controls that helps an organization implement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties.D: Physical and environment protection control are the family that provides an extensive number of controls related to physical security.
4. Right Answer: C
Explanation: The risk register does not examine the network diagram and the critical path. There may be risks associated with the activities on the network diagram, but it does not address the network diagram directly.The risk register is updated at the end of the plan risk response process with the information that was discovered during the process. The response plans are recorded in the risk register. In the risk register, risk is stated in order of priority, i.e., those with the highest potential for threat or opportunity first. Some risks might not require response plans at all, but then too they should be put on a watch list and monitored throughout the project. Following elements should appear in the risk register: List of identified risks, including their descriptions, root causes, and how the risks impact the project objectives Risk owners and their responsibility Outputs from the Perform Qualitative Analysis process Agreed-upon response strategies Risk triggers Cost and schedule activities needed to implement risk responses Contingency plans Fallback plans, which are risk response plans that are executed when the initial risk response plan proves to be ineffective Contingency reserves Residual risk, which is a leftover risk that remains after the risk response strategy has been implemented Secondary risks, which are risks that come about as a result of implementing a risk response
5. Right Answer: B
Explanation: Enhance is a risk response to improve the conditions to ensure the risk event occurs. Risk enhancement raises the probability of an opportunity to take place by focusing on the trigger conditions of the opportunity and optimizing the chances. Identifying and maximizing input drivers of these positive-impact risks may raise the probability of their occurrence.Incorrect Answers:A: Transference is a strategy to mitigate negative risks or threats. In this strategy, consequences and the ownership of a risk is transferred to a third party. This strategy does not eliminate the risk but transfers responsibility of managing the risk to another party. Insurance is an example of transference.C: Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.D: Sharing happens through partnerships, joint ventures, and teaming agreements. Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.
Explanation: As the sensitivity of the monitoring tool has to be changed, therefore it requires optimization of Key Risk Indicator. The monitoring tool which is giving alerts is itself acting as a risk indicator. Hence to change the sensitivity of the monitoring tool to give alert only for critical situations requires optimization of the KRI.Incorrect Answers:A, C, D: These options are not relevant to the change of sensitivity of the monitoring tools.
2. Right Answer: A
Explanation: Force majeure describes acts of God (Natural disaster), such as tornados and fires, and are usually accepted because there's little than can be done to mitigate these risks.Incorrect Answers:B: Transference transfers the risk ownership to a third party, usually for a fee.C: Enhance is used for a positive risk event, not for force majeure.D: Mitigation isn't the best choice, as this lowers the probability and/or impact of the risk event.
3. Right Answer: C
Explanation: Configuration management control is a family of controls that addresses both configuration management and change management. Change control practices prevent unauthorized changes. They include goals such as configuring systems for least functionality as a primary method of hardening systems.Incorrect Answers:A: The Personal security control is family of controls that includes aspects of personnel security. It includes personnel screening, termination, and transfer.B: Access control is the family of controls that helps an organization implement effective access control. They ensure that users have the rights and permissions they need to perform their jobs, and no more. It includes principles such as least privilege and separation of duties.D: Physical and environment protection control are the family that provides an extensive number of controls related to physical security.
4. Right Answer: C
Explanation: The risk register does not examine the network diagram and the critical path. There may be risks associated with the activities on the network diagram, but it does not address the network diagram directly.The risk register is updated at the end of the plan risk response process with the information that was discovered during the process. The response plans are recorded in the risk register. In the risk register, risk is stated in order of priority, i.e., those with the highest potential for threat or opportunity first. Some risks might not require response plans at all, but then too they should be put on a watch list and monitored throughout the project. Following elements should appear in the risk register: List of identified risks, including their descriptions, root causes, and how the risks impact the project objectives Risk owners and their responsibility Outputs from the Perform Qualitative Analysis process Agreed-upon response strategies Risk triggers Cost and schedule activities needed to implement risk responses Contingency plans Fallback plans, which are risk response plans that are executed when the initial risk response plan proves to be ineffective Contingency reserves Residual risk, which is a leftover risk that remains after the risk response strategy has been implemented Secondary risks, which are risks that come about as a result of implementing a risk response
5. Right Answer: B
Explanation: Enhance is a risk response to improve the conditions to ensure the risk event occurs. Risk enhancement raises the probability of an opportunity to take place by focusing on the trigger conditions of the opportunity and optimizing the chances. Identifying and maximizing input drivers of these positive-impact risks may raise the probability of their occurrence.Incorrect Answers:A: Transference is a strategy to mitigate negative risks or threats. In this strategy, consequences and the ownership of a risk is transferred to a third party. This strategy does not eliminate the risk but transfers responsibility of managing the risk to another party. Insurance is an example of transference.C: Exploit response is one of the strategies to negate risks or threats that appear in a project. This strategy may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Exploiting a risk event provides opportunities for positive impact on a project. Assigning more talented resources to the project to reduce the time to completion is an example of exploit response.D: Sharing happens through partnerships, joint ventures, and teaming agreements. Sharing response is where two or more entities share a positive risk. Teaming agreements are good example of sharing the reward that comes from the risk of the opportunity.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment