Risk Assessment CRAGE Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the primary difference between qualitative and quantitative risk analysis?

   • AQualitative analysis uses descriptive scales, while quantitative analysis uses numerical values
   • BQualitative analysis is used only for legal risks, while quantitative analysis is used for technical risks
   • CQualitative analysis is more accurate than quantitative analysis
   • DQualitative analysis is always faster than quantitative analysis
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A retail company has implemented a risk treatment for an AI supply chain risk by requiring the vendor to provide quarterly security audits. After the first year, the audits show that the vendor's security posture has significantly improved, and the risk level has decreased. However, the company's risk appetite has also become more stringent due to new regulations. What should the company do?

   • ARe-evaluate the risk against the new risk appetite and adjust the treatment plan if necessary.
   • BInform the vendor that the risk is now acceptable.
   • CKeep the current treatment plan because the risk has decreased.
   • DDiscontinue the quarterly audits because the risk is now low.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A hospital uses an AI diagnostic support system from a vendor. The system has a known risk of misdiagnosis for certain demographics. The hospital has a very low risk appetite for patient safety. The vendor offers to update the model, but this would require a 3-month downtime and significant costs. What is the most appropriate risk treatment?

   • AAccept the risk because the system is generally accurate.
   • BMitigate the risk by adding a disclaimer to the system output.
   • CTransfer the risk by obtaining patient consent forms.
   • DAvoid the risk by discontinuing use of the system for those demographics.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A telecommunications company has implemented a risk monitoring process for its AI network optimization vendor. The process includes quarterly reviews and real-time alerts for model performance degradation. What is the primary purpose of this monitoring?

   • ATo replace the need for periodic risk assessments.
   • BTo document risks for regulatory compliance only.
   • CTo transfer risk to the vendor.
   • DTo detect changes in risk levels and ensure that risk treatments remain effective.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the context of AI and third-party supply chain management, what is the primary purpose of risk assessment?

   • ATo eliminate all possible risks from the supply chain before any AI system is deployed
   • BTo assign blame to third-party vendors when an AI system fails
   • CTo guarantee that all AI systems are 100% secure and free from vulnerabilities
   • DTo identify, analyze, and evaluate potential risks that could affect the achievement of organizational objectives
   Reveal Solution Discussion Select an answer first