Risk Analysis Methodologies CRISC Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A government agency is assessing risks for a new citizen portal. The agency has some historical data on system outages but lacks data on new attack vectors. The risk team must produce a prioritized list of risks that is defensible to auditors and can be updated as new data becomes available. Which methodology is most appropriate?

   • AAd hoc risk assessment performed by each department independently
   • BPure quantitative analysis using only historical outage data
   • CSemi-quantitative analysis using a weighted scoring model that incorporates both data and expert judgment
   • DPure qualitative analysis using only expert opinion
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A non-profit organization is conducting a risk assessment for its donor database. The organization has no historical incident data and the risk team is small, but they need to quickly identify which risks require immediate attention. They decide to rate each risk as high, medium, or low for likelihood and impact. What is the primary advantage of this qualitative approach?

   • AIt eliminates the need for expert judgment
   • BIt provides a fast, cost-effective way to prioritize risks using expert judgment
   • CIt produces precise monetary values for each risk
   • DIt provides statistically valid confidence intervals
   Reveal Solution Discussion Select an answer first
3. 23foundation · easy

   In quantitative risk analysis, what does the annualized loss expectancy (ALE) represent?

   • AThe maximum possible loss from a single risk event
   • BThe expected monetary loss from a risk in a single year
   • CThe probability that a risk event will occur in a year
   • DThe total cost of all security controls implemented in a year
   Reveal Solution Discussion Select an answer first