Risk Events CRISC Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What are the two primary dimensions considered when analyzing a risk event?

   • ALikelihood and impact
   • BCause and effect
   • CThreat and vulnerability
   • DCost and benefit
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A telecommunications company is monitoring a risk event: a potential cyberattack on its network infrastructure. The risk team has established key risk indicators (KRIs) to track the likelihood of an attack. Which action would be most effective in using KRIs to monitor this risk event?

   • AUse KRIs only for risk events that have already occurred.
   • BSet KRIs once and do not change them.
   • CShare KRIs only with senior management.
   • DRegularly review KRI trends and adjust the risk assessment accordingly.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   When analyzing a risk event, what does 'impact' refer to?

   • AThe number of risk factors contributing to the event
   • BThe speed at which the event unfolds
   • CThe extent of damage or loss if the event occurs
   • DThe probability that the event will occur
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A healthcare organization has identified a risk event: a ransomware attack that could encrypt patient records. The risk team is documenting this event in the risk register. Which set of attributes should be captured to ensure the risk register is useful for future analysis and response planning?

   • APotential consequences only.
   • BDescription and likelihood only.
   • CCause and impact only.
   • DDescription, cause, likelihood, impact, and potential consequences.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A bank is analyzing the risk of a cyberattack on its online banking platform. The risk team has determined that the likelihood of an attack is high, but the impact is low because the platform has robust security controls. How should the risk team prioritize this risk event?

   • ANo priority because the impact is low.
   • BLow priority because the impact is low.
   • CMedium priority because the likelihood is high but the impact is low.
   • DHigh priority because the likelihood is high.
   Reveal Solution Discussion Select an answer first