CRISC Exam Questions and Answers | Exam-Dumps (Page: 16)

QUESTION: 76

You are working with a vendor on your project. A stakeholder has requested a change for the project, which will add value to the project deliverables. The vendor that you're working with on the project will be affected by the change. What system can help you introduce and execute the stakeholder change request with the vendor?

Contract change control system
Scope change control system
Cost change control system
Schedule change control system

Answer(s): A

Explanation:

The contract change control system is part of the project's change control system. It addresses changes with the vendor that may affect the project contract. Change control system, a part of the configuration management system, is a collection of formal documented procedures that define how project deliverables and documentation will be controlled, changed, and approved.

Incorrect Answers:
B: The scope may change because of the stakeholder change request. Vendor’s relationship to the project, hence this choice is not the best answer.

C: The cost change control system manages changes to costs in the project. D: There is no indication that the change could affect the project schedule.

Reveal Solution Next Question

QUESTION: 77

You are the project manager of GHT project. You are performing cost and benefit analysis of control. You come across the result that costs of specific controls exceed the benefits of mitigating a given risk. What is the BEST action would you choose in this scenario?

The enterprise may apply the appropriate control anyway.
The enterprise should adopt corrective control.
The enterprise may choose to accept the risk rather than incur the cost of mitigation.
The enterprise should exploit the risk.

Answer(s): C

Explanation:

If the costs of specific controls or countermeasures (control overhead) exceed the benefits of mitigating a given risk the enterprise may choose to accept the risk rather than incur the cost of mitigation. This is done according to the principle of proportionality described in:
Generally accepted security systems principles (GASSP) Generally accepted information security principles (GAISP)

Incorrect Answers:
A: When the cost of specific controls exceeds the benefits of mitigating a given risk, then controls are not applied, rather risk is being accepted.

B: As the cost of control exceeds the benefits of mitigating a given risk, hence no control should be applied. Corrective control is a type of control and hence it should not be adopted.

D: The risk is being exploited when there is an opportunity, i.e., the risk is positive. But here in this case, negative risk exists as it needs mitigation. So, exploitation cannot be done.

Reveal Solution Next Question

QUESTION: 78

Mortality tables are based on what mathematical activity?
Each correct answer represents a complete solution. Choose three.

Normal distributions
Probabilities
Impact
Sampling

Answer(s): A,B,D

Explanation:

Probability identifies the chances that a particular event will happen under certain circumstances.

The variables provided are based on information gathered in real life. For situations with large numbers, a smaller set of participants are identified to represent the larger population. This represents a sample of the population. The points are mapped to identify their distribution.
Normal distribution refers to the theoretical plotting of points against the mathematical mean. The result of these activities provides a reasonable predictability for the mortality of the subject.

Incorrect Answers:
C: Impact is used to identify the magnitude of identified risks. The risk leads to some type of loss. However, instead of quantifying the loss as a dollar value, an impact assessment could use words such as Low, Medium, or High. Hence it is not mathematical.

Reveal Solution Next Question

QUESTION: 79

Harry is the project manager of HDW project. He has identified a risk that could injure project team members. He does not want to accept any risk where someone could become injured on this project so he hires a professional vendor to complete this portion of the project work. What type of risk response is Harry implementing?

Transference
Mitigation
Acceptance
Avoidance

Answer(s): A

Explanation:

Risk transfer means that impact of risk is reduced by transferring or otherwise sharing a portion of the risk with an external organization or another internal entity. Transfer of risk can occur in many forms but is most effective when dealing with financial risks. Insurance is one form of risk transfer. Hence when Harry hires a professional vendor to manage that risk, the risk event does not go away but the responsibility for the event is transferred to the vendor.

Incorrect Answers:
B: Risk acceptance means that no action is taken relative to a particular risk; loss is accepted if it occurs. Here Harry is not accepting this risk event; he does not want anyone of his team to become injured so he's transferring the event to professional vendor.

C: Mitigation are actions that Harry's project team could take to reduce the probability and/or impact of a risk event.

D: Avoidance removes the risk event entirely either by adding additional steps to avoid the event or reducing the project scope.

Reveal Solution Next Question

QUESTION: 80

The Identify Risk process determines the risks that affect the project and document their characteristics. Why should the project team members be involved in the Identify Risk process?

They are the individuals that will most likely cause and respond to the risk events.
They are the individuals that will have the best responses for identified risks events within the project.
They are the individuals that are most affected by the risk events.
They are the individuals that will need a sense of ownership and responsibility for the risk events.

Answer(s): D

Explanation:

The project team members should be involved in the risk identification so that they will develop a sense of ownership and responsibility for the risk events and the associated risk responses.

Identify Risks is the process of determining which risks may affect the project. It also documents risks' characteristics. The Identify Risks process is part of the Project Risk Management knowledge area. As new risks may evolve or become known as the project progresses through its life cycle, Identify Risks is an iterative process. The process should involve the project team so that they can develop and maintain a sense of ownership and responsibility for the risks and associated risk response actions. Risk Register is the only output of this process.

Incorrect Answers:
A, B, C: These are not the valid answers for this question.

Reveal Solution Next Question

ISACA CRISC Exam (page: 16) ISACA Certified in Risk and Information Systems Control Updated on: 15-Feb-2026

QUESTION: 76

Explanation:

QUESTION: 77

Explanation:

QUESTION: 78

Explanation:

QUESTION: 79

Explanation:

QUESTION: 80

Explanation:

ISACA CRISC Exam (page: 16)
ISACA Certified in Risk and Information Systems Control
Updated on: 15-Feb-2026