Risk Assessment Methods CGEIT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a characteristic of a qualitative risk assessment?

   • AIt relies on subjective ratings such as high, medium, or low for likelihood and impact
   • BIt uses numerical values to calculate annualized loss expectancy
   • CIt always produces more precise results than quantitative methods
   • DIt requires extensive historical data to produce accurate results
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A financial services firm is assessing risks for a new online trading platform. They have extensive historical data on system failures and security incidents, but the data is not directly applicable to the new platform. The risk team must decide between a purely quantitative approach and a hybrid approach. The CEO wants a defensible risk assessment that can be used to set risk appetite and allocate resources. What is the best approach?

   • AUse a hybrid approach: quantitative analysis for the data that is applicable, and qualitative analysis for new risks and uncertainties.
   • BUse Monte Carlo simulation with assumptions based on the historical data, and ignore qualitative factors.
   • CUse only qualitative analysis, as the historical data is not directly applicable.
   • DUse only quantitative analysis, extrapolating the historical data to the new platform.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which statement best describes the role of risk assessment methods in enterprise IT governance?

   • AThey provide a basis for prioritizing risks and selecting appropriate risk responses
   • BThey are primarily a financial reporting tool to calculate tax liabilities
   • CThey are a one-time activity performed during system implementation
   • DThey are used only after a risk incident has occurred to determine the cause
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary goal of communicating risk assessment results to decision-makers?

   • ATo translate risk information into clear, actionable insights that support decision-making
   • BTo assign blame for risk-related failures
   • CTo satisfy regulatory reporting requirements only
   • DTo provide a detailed technical report for IT staff only
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A startup with a small risk team is assessing risks for a new mobile application. They have no historical loss data and limited time to conduct the assessment. The primary goal is to identify and prioritize risks quickly to inform the development roadmap. Which risk assessment method is most suitable?

   • ADefer the risk assessment until the app is launched and real usage data is available.
   • BQuantitative analysis using ALE, estimating values based on industry benchmarks.
   • CQualitative analysis using a risk matrix to rate likelihood and impact based on expert judgment.
   • DMonte Carlo simulation to model potential losses with assumed probability distributions.
   Reveal Solution Discussion Select an answer first