Risk Scenario Development and Evaluation CRISC Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of prioritizing risk scenarios?

   • ATo satisfy regulatory requirements only
   • BTo eliminate all risks completely
   • CTo document all possible scenarios
   • DTo focus resources on the most significant threats
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A risk analyst is documenting a risk scenario for a manufacturing company's industrial control system (ICS). The scenario involves a disgruntled employee who might use their legitimate access to alter production parameters, causing a shutdown. Which of the following correctly identifies the key components of this scenario?

   • AThreat source: disgruntled employee; threat event: altering production parameters; vulnerability: excessive access privileges; asset: ICS; impact: production shutdown.
   • BThreat source: excessive access privileges; threat event: production shutdown; vulnerability: disgruntled employee; asset: altered parameters; impact: ICS.
   • CThreat source: production shutdown; threat event: disgruntled employee; vulnerability: ICS; asset: excessive access privileges; impact: altered parameters.
   • DThreat source: ICS; threat event: excessive access privileges; vulnerability: production shutdown; asset: disgruntled employee; impact: altered parameters.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A risk team is evaluating risk scenarios for a retail company's e-commerce platform. The company's primary objective is to maximize revenue. Two scenarios have been developed: Scenario A involves a credit card data breach, which could lead to regulatory fines and loss of customer trust. Scenario B involves a website outage during the holiday shopping season, which could result in lost sales. Which scenario should be prioritized?

   • ANeither scenario, because the company cannot afford to mitigate both.
   • BScenario A, because a data breach has long-term reputational and regulatory consequences.
   • CScenario B, because it directly impacts the company's primary objective of maximizing revenue.
   • DBoth scenarios equally, because they both have high impact.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A risk team has developed 20 risk scenarios for a global bank. They have limited resources and can only address the top 5 scenarios. Which of the following approaches is the most effective for selecting the top 5 scenarios?

   • AUse a risk matrix to score each scenario based on likelihood and impact, then select the 5 with the highest scores.
   • BSelect the 5 scenarios that are easiest to mitigate, regardless of risk level.
   • CSelect the 5 scenarios that have the highest impact, ignoring likelihood.
   • DSelect the 5 scenarios that have the highest likelihood, ignoring impact.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Why do risk scenarios need to be regularly updated?

   • ABecause they are required to be updated by law.
   • BBecause the threat landscape and organizational environment change over time.
   • CBecause they are only accurate for a single day.
   • DBecause they become invalid after one year.
   Reveal Solution Discussion Select an answer first