CRISC Exam Questions and Answers | Exam-Dumps (Page: 21)

QUESTION: 101

Fred is the project manager of a large project in his organization. Fred needs to begin planning the risk management plan with the project team and key stakeholders. Which plan risk management process tool and technique should Fred use to plan risk management?

Information gathering techniques
Data gathering and representation techniques
Planning meetings and analysis
Variance and trend analysis

Answer(s): C

Explanation:

There is only one tool and technique available for Fred to plan risk management: planning meetings and analysis. Planning Meeting and Analysis is a tool and technique in the Plan Risk Management process. Planning meetings are organized by the project teams to develop the risk management plan. Attendees at these meetings include the following:

Project manager
Selected project team members Stakeholders
Anybody in the organization with the task to manage risk planning

Sophisticated plans for conducting the risk management activities are defined in these meetings, responsibilities related to risk management are assigned, and risk contingency reserve application approaches are established and reviewed.

Incorrect Answers:
A, B, D: These are not plan risk management tools and techniques.

Reveal Solution Next Question

QUESTION: 102

Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?

User management coordination does not exist
Audit recommendations may not be implemented
Users may have unauthorized access to originate, modify or delete data
Specific user accountability cannot be established

Answer(s): C

Explanation:

There is an increased risk without a policy defining who has the responsibility for granting access to specific data or systems, as one could gain system access without a justified business needs. There is better chance that business objectives will be properly supported when there is appropriate ownership.

Incorrect Answers:
A, B, D: These risks are not such significant as compared to unauthorized access.

Reveal Solution Next Question

QUESTION: 103

Marie has identified a risk event in her project that needs a mitigation response. Her response actually creates a new risk event that must now be analyzed and planned for. What term is given to this newly created risk event?

Residual risk
Secondary risk
Infinitive risk
Populated risk

Answer(s): B

Explanation:

Secondary risks are the risks that come about as a result of implementing a risk response. This new risk event must be recorded, analyzed, and planned for management.

Incorrect Answers:
A: A residual risk event is similar to a secondary risk, but is often small in probability and impact, so it may just be accepted.

C: Infinitive risk is not a valid project management term.

D: Populated risk event is not a valid project management term.

Reveal Solution Next Question

QUESTION: 104

Which one of the following is the only output for the qualitative risk analysis process?

Project management plan
Risk register updates
Organizational process assets
Enterprise environmental factors

Answer(s): B

Explanation:

Risk register update is the only output of the choices presented for the qualitative risk analysis process. The four inputs for the qualitative risk analysis process are the risk register, risk management plan, project scope statement, and organizational process assets. The output of perform qualitative risk analysis process is Risk Register Updates. Risk register is updated with the information from perform qualitative risk analysis and the updated risk register is included in the project documents. Updates include the following important elements:
Relative ranking or priority list of project risks Risks grouped by categories
Causes of risk or project areas requiring particular attention List of risks requiring response in the near-term
List of risks for additional analysis and response Watchlist of low priority risks
Trends in qualitative risk analysis results

Incorrect Answers:
A, C, D: These are not the valid outputs for the qualitative risk analysis process.

Reveal Solution Next Question

QUESTION: 105

FISMA requires federal agencies to protect IT systems and data. How often should compliance be audited by an external organization?

Annually
Quarterly
Every three years
Never

Answer(s): A

Explanation:

Inspection of FISMA is required to be done annually. Each year, agencies must have an independent evaluation of their program. The objective is to determine the effectiveness of the program. These evaluations include:
Testing for effectiveness: Policies, procedures, and practices are to be tested. This evaluation does not test every policy, procedure, and practice. Instead, a representative sample is tested.
An assessment or report: This report identifies the agency's compliance as well as lists compliance with FISMA. It also lists compliance with other standards and guidelines.

Incorrect Answers:
B, C, D: Auditing of compliance by external organization is done annually, not quarterly or every three years.

Reveal Solution Next Question

ISACA CRISC Exam (page: 21) ISACA Certified in Risk and Information Systems Control Updated on: 25-Dec-2025

QUESTION: 101

Explanation:

QUESTION: 102

Explanation:

QUESTION: 103

Explanation:

QUESTION: 104

Explanation:

QUESTION: 105

Explanation:

ISACA CRISC Exam (page: 21)
ISACA Certified in Risk and Information Systems Control
Updated on: 25-Dec-2025