CRISC Exam Questions and Answers | Exam-Dumps (Page: 17)

QUESTION: 81

What are the requirements of monitoring risk?
Each correct answer represents a part of the solution. Choose three.

Information of various stakeholders
Preparation of detailed monitoring plan
Identifying the risk to be monitored
Defining the project's scope

Answer(s): B,C,D

Explanation:

It is important to first understand the risk to be monitored, prepare a detailed plan and define the project's scope for monitoring risk. In the case of a monitoring project, this step should involve process owners, data owners, system custodians and other process stakeholders.

Incorrect Answers:
A: Data regarding stakeholders of the project is not required in any phase of risk monitoring.

Reveal Solution Next Question

QUESTION: 82

Your company is covered under a liability insurance policy, which provides various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc. Which of the following risk management techniques is your company using?

Risk transfer
Risk acceptance
Risk avoidance
Risk mitigation

Answer(s): A

Explanation:

Risk transfer is the practice of passing risk from one entity to another entity. In other words, if a company is covered under a liability insurance policy providing various liability coverage for information security risks, including any physical damage of assets, hacking attacks, etc., it means it has transferred its security risks to the insurance company.

Incorrect Answers:
B: Risk acceptance is the practice of accepting certain risk(s), typically based on a business decision that may also weigh the cost versus the benefit of dealing with the risk in another way.

C: Risk avoidance is the practice of not performing an activity that could carry risk. Avoidance may seem the answer to all risks, but avoiding risks also means losing out on the potential gain that accepting (retaining) the risk may have allowed.

D: Risk mitigation is the practice of reducing the severity of the loss or the likelihood of the loss from occurring.

Reveal Solution Next Question

QUESTION: 83

You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole. What approach can you use to achieve this goal of improving the project's performance through risk analysis with your project stakeholders?

Involve subject matter experts in the risk analysis activities
Involve the stakeholders for risk identification only in the phases where the project directly affects them
Use qualitative risk analysis to quickly assess the probability and impact of risk events
Focus on the high-priority risks through qualitative risk analysis

Answer(s): D

Explanation:

By focusing on the high-priority of risk events through qualitative risk analysis you can improve the project's performance.

Qualitative analysis is the definition of risk factors in terms of high/medium/low or a numeric scale (1 to 10). Hence it determines the nature of risk on a relative scale.

Some of the qualitative methods of risk analysis are:
Scenario analysis- This is a forward-looking process that can reflect risk for a given point in time.
Risk Control Self -assessment (RCSA) - RCSA is used by enterprises (like banks) for the identification and evaluation of operational risk exposure. It is a logical first step and assumes that business owners and managers are closest to the issues and have the most expertise as to the source of the risk. RCSA is a constructive process in compelling business owners to contemplate, and then explain, the issues at hand with the added benefit of increasing their accountability.

Incorrect Answers:
A: Subject matter experts can help the qualitative risk assessment, but by focusing on high-priority risks the project's performance can improve by addressing these risk events.

B: Stakeholders should be involved throughout the project as situations within the project demand their input to risk identification and analysis.

C: Qualitative analysis does use a fast approach of analyzing project risks, but it's not the best answer for this

Reveal Solution Next Question

QUESTION: 84

You are a project manager for your organization and you're working with four of your key stakeholders. One of the stakeholders is confused as to why you're not discussing the current problem in the project during the risk identification meeting. Which one of the following statements best addresses when a project risk actually happens?

Project risks are uncertain as to when they will happen.
Risks can happen at any time in the project.
Project risks are always in the future.
Risk triggers are warning signs of when the risks will happen.

Answer(s): C

Explanation:

According to the PMBOK, a project risk is always in the future. If the risk event has already happened, then it is an issue, not a risk.

Incorrect Answers:
A: You can identify risks before they occur and not after their occurrence. B: Risks can only happen in the future.

D: Triggers are warning signs and conditions of risk events, but this answer isn't the best choice for this question.

Reveal Solution Next Question

QUESTION: 85

Which of the following is the MOST effective method for indicating that the risk level is approaching a high or unacceptable level of risk?

Risk register
Cause and effect diagram
Risk indicator
Return on investment

Answer(s): C

Explanation:

Risk indicators are metrics used to indicate risk thresholds, i.e., it gives indication when a risk level is approaching a high or unacceptable level of risk. The main objective of a risk indicator is to ensure tracking and reporting mechanisms that alert staff about the potential risks.

Incorrect Answers:
A: A risk register is an inventory of risks and exposure associated with those risks. Risks are commonly found in project management practices, and provide information to identify, analyze, and manage risks. Typically a risk register contains:
A description of the risk
The impact should this event actually occur The probability of its occurrence
Risk Score (the multiplication of Probability and Impact)
A summary of the planned response should the event occur
A summary of the mitigation (the actions taken in advance to reduce the probability and/or impact of the event)
Ranking of risks by Risk Score so as to highlight the highest priority risks to all involved.

D: Return On Investment (ROI) is a performance measure used to evaluate the efficiency of an investment or to compare the efficiency of a number of different investments. To calculate ROI, the benefit (return) of an investment is divided by the cost of the investment; the result is expressed as a percentage or a ratio.

The return on investment formula:
ROI= (Gain from investment - Cost of investment) / Cost of investment

In the above formula "gains from investment", refers to the proceeds obtained from selling the investment of interest.

Reveal Solution Next Question

ISACA CRISC Exam (page: 17) ISACA Certified in Risk and Information Systems Control Updated on: 15-Feb-2026

QUESTION: 81

Explanation:

QUESTION: 82

Explanation:

QUESTION: 83

Explanation:

QUESTION: 84

Explanation:

QUESTION: 85

Explanation:

ISACA CRISC Exam (page: 17)
ISACA Certified in Risk and Information Systems Control
Updated on: 15-Feb-2026