Risk Scenario Development and Evaluation CRISC Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to document risk scenarios in a clear and consistent format?

   • ATo replace the need for risk analysis
   • BTo increase the number of scenarios documented
   • CTo support risk analysis and communication
   • DTo satisfy the personal preference of the risk manager
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following best describes the systematic process for developing risk scenarios?

   • AA structured approach that identifies threats, vulnerabilities, and potential impacts to create realistic scenarios.
   • BA process that focuses only on financial impacts and ignores operational and reputational factors.
   • CA one-time activity performed by senior management to set risk appetite.
   • DAn informal brainstorming session without any defined steps.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A risk manager has developed and evaluated several risk scenarios for a healthcare organization. The organization has a limited budget for risk mitigation. The risk manager must decide which scenarios to address first. The scenarios have been scored using a risk matrix, but the scores are close. Which of the following factors should the risk manager consider when prioritizing the scenarios?

   • AThe ease of documenting the scenario, as documentation is a key requirement.
   • BThe number of stakeholders affected by the scenario, regardless of risk score.
   • CThe cost of mitigation and the organization's risk appetite for each type of risk.
   • DThe likelihood of the scenario being criticized by auditors.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the first step in the systematic process for developing risk scenarios?

   • AQuantifying the financial impact
   • BIdentifying relevant threats
   • CDocumenting the scenario in a standard format
   • DSelecting risk responses
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A risk team is developing scenarios for a healthcare organization's patient portal. They have identified several potential threats, including phishing attacks, insider misuse, and system misconfiguration. To systematically develop risk scenarios, which of the following steps should they perform first?

   • ADocument the scenarios in a standard format for communication.
   • BAssign a risk score to each scenario based on likelihood and impact.
   • CPrioritize the scenarios based on their risk level.
   • DIdentify relevant threats, vulnerabilities, and potential impacts for each threat.
   Reveal Solution Discussion Select an answer first