Risk Assessment Methods CGEIT Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following best describes how risk assessment results should be presented to senior management?

   • AExclusively in financial terms without any qualitative context
   • BIn a highly technical format using complex statistical models
   • CAs a summary of key risks, their potential impact, and recommended actions
   • DOnly after a risk incident occurs
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A non-profit organization is conducting a risk assessment for its donor database. The risk team has limited expertise in statistical analysis and no historical incident data. The board wants a simple, understandable output that can be used to explain risks to stakeholders. Which risk assessment method is most appropriate?

   • AQualitative analysis using a risk matrix with ratings such as high, medium, and low.
   • BMonte Carlo simulation using assumed probability distributions for loss events.
   • CQuantitative analysis using ALE with estimated values from similar organizations.
   • DA hybrid approach that combines ALE for known risks and qualitative for unknown risks.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the first step in conducting a structured risk assessment?

   • AImplementing risk mitigation controls
   • BIdentifying risk scenarios
   • CEvaluating the likelihood and impact of each risk
   • DDefining the scope and objectives of the assessment
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which risk assessment standard is published by the U.S. National Institute of Standards and Technology (NIST) and provides detailed guidance for conducting risk assessments of information systems?

   • AISO 27001
   • BCOBIT 5
   • CNIST SP 800-30
   • DPMBOK Guide
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which activity is part of the risk analysis phase of a risk assessment?

   • ADetermining the likelihood and impact of identified risks
   • BImplementing security controls
   • CDefining the risk assessment scope
   • DSelecting risk treatment options
   Reveal Solution Discussion Select an answer first