Risk Scenario Development and Evaluation CRISC Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a recognized limitation of risk scenarios?

   • AThey are based on assumptions and may not predict all future events.
   • BThey are always accurate and reliable.
   • CThey eliminate the need for ongoing monitoring.
   • DThey are only useful for IT risks.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A risk manager is evaluating a set of risk scenarios for a retail company's e-commerce platform. The company's primary objective is to maintain customer trust and avoid financial losses. Which of the following scenarios should be considered the highest priority based on the evaluation criteria of likelihood, impact, and relevance to objectives?

   • AA distributed denial-of-service (DDoS) attack that could make the website unavailable for several hours, with a moderate likelihood and high impact on sales and customer trust.
   • BA physical break-in at a remote warehouse that could result in theft of office supplies, with a low likelihood and low impact.
   • CA minor misconfiguration in the web server that could cause a brief display error on a non-critical page, with a high likelihood but very low impact.
   • DA regulatory fine due to non-compliance with data protection laws, with a low likelihood but very high impact on the company's finances and reputation.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following is the most accurate example of a risk scenario?

   • AAll employees must complete security awareness training annually.
   • BA disgruntled employee uses their valid credentials to exfiltrate customer data from the CRM system, resulting in regulatory fines and reputational damage.
   • CThe firewall may be misconfigured, which could allow unauthorized access.
   • DThe organization has a high risk appetite for new product development.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is NOT a key component of a risk scenario?

   • AVulnerability
   • BRisk appetite
   • CThreat source
   • DImpact
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In the risk assessment process, what is the primary role of risk scenarios?

   • ATo provide a final decision on risk treatment
   • BTo serve as the basis for identifying and analyzing risks
   • CTo document all past incidents
   • DTo replace the need for vulnerability assessments
   Reveal Solution Discussion Select an answer first