Risk Scenario Development and Evaluation CRISC Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A risk analyst is documenting risk scenarios for a bank's mobile banking application. To ensure the documentation supports clear communication and consistent analysis, which of the following is the most important practice?

   • AUse a standardized template that includes fields for threat source, event, vulnerability, asset, impact, and likelihood.
   • BDocument only the impact of each scenario, as that is the most important component.
   • CWrite each scenario in a narrative paragraph without any structured fields.
   • DDocument scenarios in a format that is only understandable by the risk team, to avoid misinterpretation.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A multinational corporation is evaluating risk scenarios for its new cloud-based customer relationship management (CRM) system. The company operates in a jurisdiction with strict data residency requirements. Two scenarios have been developed: Scenario A involves a data breach due to a misconfigured cloud storage bucket, and Scenario B involves a prolonged outage of the cloud service provider. The company's risk appetite is low for data breaches but moderate for service outages. Which scenario should be prioritized?

   • ABoth scenarios equally, because they both have the same likelihood and impact.
   • BScenario A, because the company's low risk appetite for data breaches makes it a higher priority.
   • CScenario B, because a prolonged outage could affect all customers and have a broader impact.
   • DNeither scenario, because the company's risk appetite is too low to accept any risk.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   How are risk scenarios used within the overall risk assessment process?

   • AThey provide a structured way to identify and analyze specific risks.
   • BThey are used to determine the organization's risk appetite.
   • CThey replace the need for a risk register.
   • DThey are only used for compliance reporting.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which statement best defines a risk scenario in the context of risk assessment?

   • AA list of all potential threats that could affect any asset in the organization.
   • BA quantitative formula used to calculate the annualized loss expectancy for a single asset.
   • CA description of a specific threat event that could impact an asset, including the threat source, event, and consequence.
   • DA general statement of the organization's risk appetite and tolerance levels.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A risk manager has developed a set of risk scenarios for a telecommunications company. After six months, the company has adopted new technologies and the threat landscape has changed. What is the most appropriate action regarding the risk scenarios?

   • AReview and update the scenarios to reflect the new technologies and current threats.
   • BKeep the scenarios unchanged, as they were validated by the risk committee.
   • CDiscard all scenarios and start from scratch, as they are no longer useful.
   • DOnly update the scenarios if a risk event has occurred.
   Reveal Solution Discussion Select an answer first