Risk Scenario Development and Evaluation CRISC Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which of the following is a primary criterion used to evaluate risk scenarios?

   • AAge of the risk assessment team
   • BLikelihood
   • CColor of the risk register
   • DNumber of stakeholders involved
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A risk analyst is developing risk scenarios for a hospital's electronic health record (EHR) system. The analyst has identified a threat source (a hacker), a threat event (ransomware infection), and a vulnerability (unpatched software). What is the next step in the development process?

   • ADetermine the potential impact on the EHR system and patient care.
   • BImmediately implement a patch management process.
   • CMove on to the next threat source without further analysis.
   • DDocument the scenario without considering the impact.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   In a risk scenario, what does the 'asset' component refer to?

   • AThe person or entity that initiates the threat event
   • BThe likelihood that the threat event will occur
   • CThe weakness that could be exploited
   • DThe resource that could be harmed or lost
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   When evaluating risk scenarios, why is 'relevance to the organization's objectives' an important criterion?

   • AIt replaces the need to assess likelihood and impact.
   • BIt determines the exact financial loss for each scenario.
   • CIt ensures that scenarios align with the organization's strategic goals and priorities.
   • DIt is only relevant for compliance-related risks.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a key benefit of using a standardized template for documenting risk scenarios?

   • AIt ensures all scenarios include the same essential components.
   • BIt guarantees that all scenarios are accurate.
   • CIt automatically eliminates low-priority scenarios.
   • DIt reduces the need for stakeholder communication.
   Reveal Solution Discussion Select an answer first