Risk Assessment Methods CGEIT Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   An enterprise is conducting a risk assessment for a major IT transformation project. The project has a tight deadline, and the risk team has limited resources. The CIO wants the assessment to be comprehensive but also completed in time to inform the project plan. What is the most effective way to conduct the risk assessment under these constraints?

   • AUse a qualitative method only, as it is faster and requires fewer resources.
   • BUse a comprehensive quantitative analysis for all risks, even if it takes longer than the deadline.
   • CDefine a clear scope and use a qualitative method to quickly identify and prioritize risks, then conduct detailed quantitative analysis only for the top risks.
   • DDefer the risk assessment until after the project plan is developed, to ensure accuracy.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An IT governance team is conducting a risk assessment for a new customer relationship management (CRM) system. The team has identified potential risks such as data loss, unauthorized access, and system downtime. What is the next step in the risk assessment process after identifying risks?

   • ASelect a risk assessment framework to guide the analysis.
   • BAnalyze the risks by determining their likelihood and potential impact.
   • CImplement risk mitigation controls for all identified risks immediately.
   • DCommunicate the identified risks to the board for approval.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   An organization has limited historical data on IT security incidents and needs a quick, high-level view of risks to prioritize areas for further analysis. Which risk assessment method is most suitable?

   • AAnnualized loss expectancy (ALE) calculation
   • BQuantitative risk assessment using Monte Carlo simulation
   • CQualitative risk assessment using expert judgment and risk ratings
   • DA full quantitative analysis of all identified risks
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is a common advantage of using a qualitative risk assessment approach?

   • AIt produces results that are independent of the assessor's perspective
   • BIt is faster and easier to perform than quantitative assessments
   • CIt provides precise monetary values for risk exposure
   • DIt eliminates the need for expert judgment
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A multinational enterprise is adopting a risk assessment framework to standardize its risk management practices across all business units. The framework must be principle-based and applicable to any type of risk, not just IT. Which framework is most appropriate?

   • ACOBIT, because it focuses on IT governance and control objectives.
   • BNIST SP 800-30, because it provides detailed steps for IT risk assessments.
   • CThe organization's own internal framework, because it can be tailored to its specific needs.
   • DISO 31000, because it provides principles and guidelines for risk management applicable to any organization.
   Reveal Solution Discussion Select an answer first