Risk Analysis Methodologies CRISC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A hospital is assessing the risk of a medical device failure. The hospital has detailed maintenance logs and failure rates for the device, but the clinical impact of a failure is difficult to quantify in monetary terms. The risk team needs to decide whether to invest in a backup device. Which methodology is most appropriate?

   • ASemi-quantitative analysis using a single score for the entire risk
   • BQuantitative analysis for the failure frequency and qualitative analysis for the clinical impact
   • CPure quantitative analysis using only the failure rate data
   • DPure qualitative analysis using expert opinion on both frequency and impact
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A manufacturing company is assessing the risk of a production line failure. The asset value is $2,000,000, the exposure factor is 0.5, and the annualized rate of occurrence is 0.2. What is the annualized loss expectancy (ALE)?

   • A$200,000
   • B$2,000,000
   • C$400,000
   • D$1,000,000
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An energy company is assessing risks across its portfolio of assets. The risk team has some quantitative data for certain assets but not for others. They need a consistent, repeatable method to compare risks across the entire portfolio and prioritize investments. Which methodology is most appropriate?

   • AAd hoc expert judgment for each asset
   • BPure qualitative analysis using a red/amber/green rating
   • CPure quantitative analysis using ALE for all assets
   • DSemi-quantitative risk analysis using a scoring model
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is a common output of qualitative risk analysis?

   • AA probability distribution of potential losses
   • BA risk rating such as high, medium, or low
   • CA monetary value such as annualized loss expectancy
   • DA cost-benefit ratio for each control
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A bank is assessing the risk of a phishing attack on its employees. The asset value of the affected systems is $2,000,000, and the exposure factor is 0.4. Historical data shows a successful phishing attack occurs once every 2 years. What is the annualized loss expectancy (ALE)?

   • A$400,000
   • B$800,000
   • C$1,000,000
   • D$2,000,000
   Reveal Solution Discussion Select an answer first