CompTIA
Checkpoint
ISC
HP
Dell
EC-Council
EXIN
Fortinet
ITIL®
Juniper
PMI
Microsoft
VMware
Avaya
Google
Salesforce
Amazon
Palo Alto Networks
Certiport
ISC2
All Vendors
  2. Home
  3. Exams
  4. ISACA
  5. CRISC

Free CRISC Exam Braindumps (page: 38)

Page 37 of 451
PDF with 1871 Questions

Which of the following is an output of risk assessment process?

  1. Identification of risk
  2. Identification of appropriate controls
  3. Mitigated risk
  4. Enterprise left with residual risk

Answer(s): B

Explanation:

The output of the risk assessment process is identification of appropriate controls for reducing or eliminating risk during the risk mitigation process. To determine the likelihood of a future adverse event, threats to an IT system must be analyzed in conjunction with the potential vulnerabilities and the controls in place for the IT system.

Once risk factors have been identified, existing or new controls are designed and measured for their strength and likelihood of effectiveness. Controls are preventive, detective or corrective; manual or programmed; and formal or ad hoc.

Incorrect Answers:
A: Risk identification acts as input of the risk assessment process.

C: This is an output of risk mitigation process, that is, after applying several risk responses. D: Residual risk is the latter output after appropriate control.



What is the IMMEDIATE step after defining set of risk scenarios?

  1. Risk mitigation
  2. Risk monitoring
  3. Risk management
  4. Risk analysis

Answer(s): D

Explanation:

Once the set of risk scenarios is defined, it can be used for risk analysis. In risk analysis, likelihood and impact of the scenarios are assessed. Important components of this assessment are the risk factors.

Incorrect Answers:
A: Risk mitigation is the latter step after analyzing risk.

B: Risk monitoring is the latter step after risk analysis and risk mitigation.

C: Risk analysis comes under risk management, therefore management is a generalized term, and is not the best answer for this question.



Which of the following statements are true for risk communication? Each correct answer represents a complete solution. Choose three.

  1. It requires a practical and deliberate scheduling approach to identify stakeholders, actions, and concerns.
  2. It helps in allocating the information concerning risk among the decision-makers.
  3. It requires investigation and interconnectivity of procedural, legal, social, political, and economic factors.
  4. It defines the issue of what a stakeholder does, not just what it says.

Answer(s): A,C,D

Explanation:

Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.

Risk communication helps in switching or allocating the information concerning risk among the decision-maker and the stakeholders.

Risk communication can be explained more clearly with the help of the following definitions: It defines the issue of what a group does, not just what it says.
It must take into account the valuable element in user's perceptions of risk. It will be more valuable if it is thought of as conversation, not instruction.

Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.

Incorrect Answers:
B: It helps in allocating the information concerning risk not only among the decision-makers but also stakeholders.



Which of the following is the most accurate definition of a project risk?

  1. It is an unknown event that can affect the project scope.
  2. It is an uncertain event or condition within the project execution.
  3. It is an uncertain event that can affect the project costs.
  4. It is an uncertain event that can affect at least one project objective.

Answer(s): D

Explanation:

Risk is an uncertain event or condition that, if it occurs, has an effect on at least one project objective. Project risk is concerned with the expected value of one or more results of one or more future events in a project. It is an uncertain condition that, if it occurs, has an effect on at least one project objective. Objectives can be scope, schedule, cost, and quality. Project risk is always in the future.

Incorrect Answers:
A: Risk is not unknown, it is uncertain; in addition, the event can affect at least one project objective - not just the project scope.

B: This statement is almost true, but the event does not have to happen within project execution. C: Risks can affect time, costs, or scope, rather affecting only cost.






Post your Comments and Discuss ISACA CRISC exam with other Community members:

CRISC Discussions & Posts