Risk Scenario Development and Evaluation CRISC Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A risk manager has developed risk scenarios for a manufacturing company. The scenarios are based on historical data and expert judgment. Which of the following limitations of risk scenarios should the manager be most aware of?

   • ARisk scenarios are based on assumptions and may not predict all possible future events.
   • BRisk scenarios are only useful for known threats and cannot be used for emerging risks.
   • CRisk scenarios are always accurate and do not need to be updated.
   • DRisk scenarios can eliminate all uncertainty in risk assessment.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which of the following is the most appropriate basis for prioritizing risk scenarios?

   • AThe risk level, which combines likelihood and impact
   • BThe personal preference of the risk manager
   • CThe number of words in the scenario description
   • DThe order in which scenarios were identified
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A risk team is developing risk scenarios for a financial institution's new online payment system. The team has limited time and resources. They have identified several potential threats, but they are unsure how to prioritize their development efforts. Which of the following approaches is the most effective for developing a manageable set of risk scenarios?

   • ADevelop scenarios only for threats that have occurred in the past.
   • BDevelop scenarios only for threats that are easy to mitigate.
   • CDevelop scenarios for every possible threat, regardless of relevance or impact.
   • DFocus on developing scenarios for threats that are most relevant to the organization's objectives and have the highest potential impact.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization is evaluating two risk scenarios. Scenario A has a high likelihood and a moderate impact. Scenario B has a low likelihood but a very high impact. The organization's risk appetite is low, and it cannot tolerate high-impact events. Which scenario should be prioritized?

   • AScenario B, because the organization's low risk appetite cannot tolerate high-impact events.
   • BScenario A, because high likelihood means it will probably occur.
   • CBoth scenarios equally, because they have the same risk score.
   • DNeither scenario, because the risk appetite is too low to accept any risk.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A risk assessment team is conducting a risk assessment for a software development company. They have developed a set of risk scenarios. How should these scenarios be used within the overall risk assessment process?

   • AUse the scenarios to replace the entire risk assessment process, as they provide all necessary information.
   • BUse the scenarios only as a communication tool for stakeholders, without any analytical purpose.
   • CUse the scenarios as a basis for identifying and analyzing specific risks, and then aggregate the results to understand the overall risk exposure.
   • DUse the scenarios to determine the exact probability of each risk event occurring.
   Reveal Solution Discussion Select an answer first