Risk Assessment CRAGE Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   What is the purpose of risk evaluation in the risk assessment process?

   • ATo monitor risks on an ongoing basis
   • BTo implement controls to reduce the likelihood of risks
   • CTo compare identified risks against established criteria to determine which need treatment
   • DTo identify all possible risks that could affect the organization
   Reveal Solution Discussion Select an answer first
2. 42expert · hard · select all that apply

   A company uses an AI chatbot for customer support. The chatbot has a risk of providing incorrect information, leading to customer dissatisfaction. The company has a low risk appetite for customer experience. Select all that apply. Which of the following are appropriate risk treatment options?

   • AMitigate by improving the chatbot's training data.
   • BAccept the risk because the chatbot is generally helpful.
   • CAvoid by disabling the chatbot for complex queries.
   • DTransfer by using a third-party liability insurance.
   • EMitigate by adding a human review process for chatbot responses.
   Check answers Discussion Select an answer first
4. 43foundation · easy

   In risk analysis, what does 'likelihood' refer to?

   • AThe cost of mitigating the risk
   • BThe potential severity of the impact if the risk occurs
   • CThe speed at which a risk can be detected
   • DThe probability that a risk event will occur
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   When an organization decides to purchase cyber insurance to cover potential losses from an AI vendor data breach, which risk treatment option are they using?

   • ATransfer
   • BAvoidance
   • CMitigation
   • DAcceptance
   Reveal Solution Discussion Select an answer first
6. 45foundation · easy

   Why is ongoing monitoring of AI supply chain risks important?

   • ABecause it is required by law in all jurisdictions
   • BBecause risk assessment is a one-time activity that needs to be documented
   • CBecause it guarantees that all risks will be eliminated
   • DBecause risks can change over time due to new threats, vendor changes, or regulatory updates
   Reveal Solution Discussion Select an answer first