CRISC Exam Questions and Answers | Exam-Dumps (Page: 18)

QUESTION: 86

You work as the project manager for Bluewell Inc. Your project has several risks that will affect several stakeholder requirements. Which project management plan will define who will be available to share information on the project risks?

Risk Management Plan
Stakeholder management strategy
Communications Management Plan
Resource Management Plan

Answer(s): C

Explanation:

The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project.

The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project.

Incorrect Answers:
A: The Risk Management Plan defines risk identification, analysis, response, and monitoring. B: The stakeholder management strategy does not address risk communications.
D: The Resource Management Plan does not define risk communications.

Reveal Solution Next Question

QUESTION: 87

Your project spans the entire organization. You would like to assess the risk of your project but worried about that some of the managers involved in the project could affect the outcome of any risk identification meeting. Your consideration is based on the fact that some employees would not want to publicly identify risk events that could declare their supervision as poor. You would like a method that would allow participants to anonymously identify risk events. What risk identification method could you use?

Delphi technique
Root cause analysis
Isolated pilot groups
SWOT analysis

Answer(s): A

Explanation:

The Delphi technique uses rounds of anonymous surveys to build consensus on project risks. Delphi is a technique to identify potential risk. In this technique, the responses are gathered via a QUESTION: and their inputs are organized according to their contents. The collected responses are sent back to these experts for further input, addition, and comments. The final list of risks in the project is prepared after that. The participants in this technique are anonymous and therefore it helps prevent a person from unduly influencing the others in the group. The Delphi technique helps in reaching the consensus quickly.

Incorrect Answers:
B: Root cause analysis is not an anonymous approach to risk identification. C: Isolated pilot groups is not a valid risk identification activity.
D: SWOT analysis evaluates the strengths, weaknesses, opportunities, and threats of the project.

Reveal Solution Next Question

QUESTION: 88

Which of the following represents lack of adequate controls?

Vulnerability
Threat
Asset
Impact

Answer(s): A

Explanation:

Vulnerability is a weakness or lack of safeguard that can be exploited by a threat, thus causing harm to the information systems or networks. It can exist in hardware, operating systems, firmware, applications, and configuration files. Hence lack of adequate controls represents vulnerability and would ultimately cause threat to the enterprise.

Incorrect Answers:
B: Threat is the potential cause of unwanted incident.

C: Assets are economic resources that are tangible or intangible, and is capable of being owned or controlled to produce value.

D: Impact is the measure of the financial loss that the threat event may have.

Reveal Solution Next Question

QUESTION: 89

The only output of qualitative risk analysis is risk register updates. When the project manager updates the risk register he will need to include several pieces of information including all of the following except for which one?

Trends in qualitative risk analysis
Risk probability-impact matrix
Risks grouped by categories
Watchlist of low-priority risks

Answer(s): B

Explanation:

The risk matrix is not included as part of the risk register updates. There are seven things that can be updated in the risk register as a result of qualitative risk analysis: relating ranking of project risks, risks grouped by categories, causes of risks, list of near-term risks, risks requiring additional analysis, watchlist of low-priority risks, trends in qualitative risk analysis.

Incorrect Answers:
A: Trends in qualitative risk analysis are part of the risk register updates. C: Risks grouped by categories are part of the risk register updates.
D: Watchlist of low-priority risks is part of the risk register updates.

Reveal Solution Next Question

QUESTION: 90

Which of the following risks is the risk that happen with an important business partner and affects a large group of enterprises within an area or industry?

Contagious risk
Reporting risk
Operational risk
Systemic risk

Answer(s): D

Explanation:

Systemic risks are those risks that happen with an important business partner and affect a large group of enterprises within an area or industry. An example would be a nationwide air traffic control system that goes down for an extended period of time (six hours), which affects air traffic on a very large scale.

Incorrect Answers:
A: Contagious risks are those risk events that happen with several of the enterprise's business partners within a very short time frame.

B, C: Their scopes do not limit to the important or general enterprise's business partners. These risks can occur with both.

Operational risks are those risks that are associated with the day-to-day operations of the enterprise. It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.

Reporting risks are caused due to wrong reporting which leads to bad decision. This bad decision due to wrong report hence causes a risk on the functionality of the organization.

Reveal Solution Next Question

ISACA CRISC Exam (page: 18) ISACA Certified in Risk and Information Systems Control Updated on: 15-Feb-2026

QUESTION: 86

Explanation:

QUESTION: 87

Explanation:

QUESTION: 88

Explanation:

QUESTION: 89

Explanation:

QUESTION: 90

Explanation:

ISACA CRISC Exam (page: 18)
ISACA Certified in Risk and Information Systems Control
Updated on: 15-Feb-2026