Risk Assessment CRAGE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A multinational corporation has completed a risk assessment of its AI supply chain. The risk register contains risks with different severity levels, and the board needs to decide on budget allocation for risk treatment. What is the most effective way to communicate the findings to the board?

   • AShare the raw data from the risk analysis tools without interpretation.
   • BProvide a detailed technical report listing every risk with its likelihood and impact scores.
   • CPresent a prioritized risk register with a clear summary of high-priority risks and recommended treatment options.
   • DSend the full risk assessment document to the board for self-review.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A technology company is analyzing risks in its AI supply chain. For a specific risk, the team has two estimates: one from a qualitative analysis that rates the risk as 'medium' and one from a quantitative analysis that calculates an expected annual loss of $50,000. The company's risk criteria classify risks with an expected annual loss above $40,000 as high. The qualitative analysis used a 3x3 matrix. Which result should the company use for risk evaluation?

   • AUse the quantitative result because it provides a more precise basis for comparison to the criteria.
   • BUse the average of the two results.
   • CUse the higher of the two results to be conservative.
   • DUse the qualitative result because it is easier to understand.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard · select all that apply

   A manufacturing company uses an AI predictive maintenance system from a vendor. The system has a risk of false alarms, leading to unnecessary maintenance costs. The company has a moderate risk appetite. Select all that apply. Which of the following are appropriate risk analysis and evaluation steps?

   • AImmediately implement a mitigation plan without analysis.
   • BAssess the financial impact of unnecessary maintenance.
   • CEstimate the likelihood of false alarms using historical data.
   • DCompare the risk level against the company's risk tolerance.
   • EIgnore the risk because false alarms are not critical.
   Check answers Discussion Select an answer first
5. 24foundation · easy

   Which risk treatment option involves taking action to reduce the likelihood or impact of a risk?

   • AAcceptance
   • BTransfer
   • CMitigation
   • DAvoidance
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   After a risk assessment, an organization has identified several AI supply chain risks. The risk management team needs to communicate the results to different stakeholders, including the IT department, legal team, and executive leadership. What is the best approach?

   • ACommunicate only after all risks are fully mitigated.
   • BOnly communicate risks that are high priority.
   • CTailor the communication to each stakeholder group's needs and level of detail.
   • DSend the same detailed risk report to all stakeholders.
   Reveal Solution Discussion Select an answer first