Risk Assessment Concepts and Standards CRISC Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company is assessing the risk of a data breach. They have identified that the likelihood is low, but the impact is very high. According to risk assessment concepts, what is the risk level?

   • ACannot be determined without a defined risk matrix
   • BHigh
   • CMedium
   • DLow
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An organization is required to conduct a risk assessment for a new system. The project manager wants to use ISO 31000, while the IT security team prefers NIST SP 800-30. The organization must also comply with industry regulations that require a specific risk assessment process. What is the best approach?

   • AUse ISO 31000 because it is a broader standard
   • BUse a custom framework developed internally
   • CUse both frameworks, with ISO 31000 as the overarching framework and NIST SP 800-30 for the IT risk assessment
   • DUse NIST SP 800-30 because it is more detailed
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A risk analyst is calculating the risk for a new application. The likelihood of a threat exploiting a vulnerability is rated as high, and the impact is rated as moderate. Using a qualitative risk matrix, what is the overall risk level?

   • ACritical
   • BModerate
   • CLow
   • DHigh
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During a risk assessment, a security analyst identifies that a server has an unpatched vulnerability. An attacker could exploit this to gain unauthorized access. In this context, what is the unpatched vulnerability?

   • AAn impact
   • BA risk
   • CA threat
   • DA vulnerability
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A risk analyst is assessing the risk of a data breach. The likelihood is low, but the impact is catastrophic. The organization has a low risk appetite. What should the analyst recommend?

   • AAccept the risk because likelihood is low
   • BAvoid the risk by discontinuing the activity
   • CTransfer the risk through insurance
   • DImplement controls to reduce the impact
   Reveal Solution Discussion Select an answer first