A manufacturing company is assessing risks in its supply chain. They have detailed data on supplier performance and delivery times, but they also need to consider the reputational impact of a supply chain disruption. The risk team wants to produce a risk register that includes both financial and non-financial impacts. Which approach is most effective?

Use quantitative analysis for delivery time variability and qualitative analysis for reputational impact, then combine in a risk register.

Use Monte Carlo simulation for all risks, including reputational impact modeled as a probability distribution.

Use only quantitative analysis, converting reputational impact into monetary terms using estimates.

Use only qualitative analysis, rating all risks on a high/medium/low scale.

In the context of enterprise IT governance, what is the primary purpose of a risk assessment method within the broader risk optimization process?

To document risks for compliance purposes only

To guarantee that all risks are transferred to third parties

To eliminate all potential risks to the enterprise

To provide a structured way to identify, analyze, and evaluate risks so that informed decisions can be made

An enterprise has detailed historical data on system failures and financial impacts, and decision-makers require a cost-benefit analysis of potential risk mitigation controls. Which risk assessment method is most appropriate?

Delphi technique to gather expert opinions

SWOT analysis to identify strengths and weaknesses

Quantitative risk assessment using ALE and Monte Carlo simulation

Qualitative risk assessment using a risk matrix

After completing a quantitative risk assessment, the risk team has produced detailed ALE calculations for various IT assets. The board members are not familiar with ALE and prefer a clear, concise summary that supports decision-making. What is the most effective way to communicate the results?

Provide the full ALE spreadsheet with all calculations and assumptions to the board.

Present a summary dashboard showing ALE values in a ranked bar chart, with a brief explanation of the methodology.

Send a technical memo detailing the Monte Carlo simulation parameters and confidence intervals.

Verbally describe the top three risks without any supporting documentation.

In a hybrid risk assessment, which scenario best illustrates the combined use of qualitative and quantitative methods?

Using only historical loss data to calculate ALE for all identified risks

Conducting interviews with stakeholders to identify risks and then documenting them in a risk register

Applying a single standardized risk assessment framework without any customization

Using a risk matrix to rate risks as high, medium, or low, and then performing a Monte Carlo simulation on the high-rated risks

Certified in the Governance of Enterprise IT

Domain 4Objective 7

Risk Assessment Methods CGEIT Practice Questions (Page 6)

Part of the Risk Optimization domain, which accounts for 19% of the CGEIT exam.

30questions here

6free pages

8concepts

19%of the exam

Questions 26–30

26application · medium
A manufacturing company is assessing risks in its supply chain. They have detailed data on supplier performance and delivery times, but they also need to consider the reputational impact of a supply chain disruption. The risk team wants to produce a risk register that includes both financial and non-financial impacts. Which approach is most effective?
Select an answer first
27foundation · easy
In the context of enterprise IT governance, what is the primary purpose of a risk assessment method within the broader risk optimization process?
Select an answer first
28foundation · easy
An enterprise has detailed historical data on system failures and financial impacts, and decision-makers require a cost-benefit analysis of potential risk mitigation controls. Which risk assessment method is most appropriate?
Select an answer first
29application · medium
After completing a quantitative risk assessment, the risk team has produced detailed ALE calculations for various IT assets. The board members are not familiar with ALE and prefer a clear, concise summary that supports decision-making. What is the most effective way to communicate the results?
Select an answer first
30foundation · easy
In a hybrid risk assessment, which scenario best illustrates the combined use of qualitative and quantitative methods?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to CGEIT

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by ISACA. “CGEIT” is a trademark of its owner, used for identification only.