Risk Assessment Methods CGEIT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which of the following is a widely recognized risk assessment framework that provides principles and guidelines for risk management, applicable to enterprise IT governance?

   • AISO 31000
   • BTOGAF
   • CITIL 4
   • DCOBIT 2019
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which technique is commonly used in quantitative risk assessment to model the range of possible outcomes by running many simulations with random inputs?

   • ADelphi technique
   • BRoot cause analysis
   • CSWOT analysis
   • DMonte Carlo simulation
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A large enterprise is assessing the risk of a cyberattack on its critical infrastructure. The risk team has detailed data on the frequency of attacks and the cost per incident, but the data is highly variable. The board wants a single number to represent the annualized loss expectancy (ALE) to use in budget planning. However, the risk team is concerned that a single ALE may not capture the variability. What is the best way to address this concern?

   • AUse the best-case ALE to keep the budget conservative.
   • BUse Monte Carlo simulation to generate a distribution of ALE values and present the expected value along with a confidence interval.
   • CUse the worst-case ALE to ensure the budget is sufficient for the most severe scenario.
   • DCalculate a single ALE using the average loss and average frequency, and present it as the definitive figure.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A risk assessment has produced a list of risks with both qualitative ratings (high/medium/low) and quantitative ALE values. The executive team is divided: some prefer the simplicity of the qualitative ratings, while others want the financial detail of ALE. What is the best way to present the results to satisfy both groups?

   • APresent only the qualitative ratings, as they are easier for executives to understand.
   • BPresent only the ALE values, as they provide a more objective basis for decision-making.
   • CPresent a risk matrix that shows qualitative ratings, with ALE values displayed as a secondary data point for each risk.
   • DPresent two separate reports: one qualitative and one quantitative, and let executives choose which to read.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An enterprise IT governance team is initiating a risk assessment for a new cloud migration project. The project sponsor wants the assessment completed within two weeks to meet a regulatory deadline. The team has limited historical data on cloud-related incidents. What is the most appropriate first step in conducting the risk assessment?

   • AImmediately conduct a quantitative analysis using Monte Carlo simulation to estimate potential financial losses.
   • BInterview key stakeholders to gather their concerns and perceptions about the cloud migration risks.
   • CDefine the scope and objectives of the risk assessment, including the systems, data, and regulatory requirements in scope.
   • DSelect a risk assessment framework such as ISO 31000 and begin documenting risks based on the framework's generic categories.
   Reveal Solution Discussion Select an answer first