Risk Analysis Methodologies CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization needs to justify security investments with monetary figures to senior management. Which risk analysis methodology is most suitable?

   • AQuantitative risk analysis
   • BScenario analysis
   • CSemi-quantitative risk analysis
   • DQualitative risk analysis
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A technology startup is preparing for a Series A funding round. Investors require a risk assessment that demonstrates the company understands its key risks, but the startup has very little historical data. The CEO wants to avoid over-engineering the process and needs results within two weeks. Which methodology is most appropriate?

   • ASemi-quantitative analysis with a complex weighted scoring model
   • BQuantitative risk analysis using Monte Carlo simulation
   • CQualitative risk analysis using a structured workshop with key stakeholders
   • DDefer the risk assessment until after funding is secured
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A multinational bank is assessing cyber risk for its online banking platform. The bank has extensive historical data on fraud losses and system outages, but the risk committee is concerned about reputational impact that is difficult to quantify. The bank must produce a risk report that satisfies both the board's desire for financial figures and the regulators' expectation of a qualitative narrative. Which approach best meets these competing requirements?

   • AUse semi-quantitative analysis with a single score for each risk
   • BUse only qualitative analysis to avoid inconsistencies between methods
   • CUse only quantitative analysis and convert reputational impact to monetary estimates
   • DUse quantitative analysis for financial risks and qualitative analysis for reputational risks, then combine in the report
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A financial services firm is conducting a risk assessment for a new mobile payment application. The organization has historical loss data for similar applications, including frequency and impact in monetary terms. The risk team needs to prioritize risks to justify budget allocation for controls. Which risk analysis methodology is most appropriate?

   • AScenario analysis with expert judgment for each risk
   • BQualitative risk analysis using a high/medium/low rating scale
   • CQuantitative risk analysis using annualized loss expectancy (ALE)
   • DSemi-quantitative analysis using a risk scoring matrix
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which risk analysis methodology is most appropriate when an organization has limited historical data but needs to quickly prioritize risks?

   • AMonte Carlo simulation
   • BAnnualized loss expectancy calculation
   • CQualitative risk analysis
   • DQuantitative risk analysis
   Reveal Solution Discussion Select an answer first