Free CRISC sample questions

Correct answer: Key risk indicators (KRIs)

C

Correct answer: US $500,000 loss

C--Explanation: Denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of person or persons to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely. Perpetrators of DoS attacks typically target sites or services hosted on high-profile web servers such as banks, credit card payment gateways, and even root name-servers. The term is generally used with regards to computer networks, but is not limited to this field; for example, it is also used in reference to CPU resource management. As the total revenue of the website for the day is $1 million, and due to denial of service attack it is unavailable for half day. Therefore, Revenue loss = $1,000,000/2 = $500,000

Correct answers: Cost management plan; Project scope statement; Schedule management plan

A,C,D

A,C,D

A,C,D

Correct answer: Exploit

Explanation: Exploit is a method for handling positive project risk.

Correct answer: stay current with existing control status

B

Correct answer: An overall statement of information security scope and direction

A--Explanation: A policy is an executive mandate which helps in identifying a topic that contains particular risks to avoid or prevent. Policies are high-level documents signed by a person of high authority with the power to force cooperation. The policy is a simple document stating that a particular high-level control objective is important to the organization's success. Policies are usually only one page in length. The authority of the person mandating a policy will determine the scope of implementation. Hence in other words, policy is an overall statement of information security scope and direction.

Correct answer: They are the individuals that will need a sense of ownership and responsibility for the risk events.

A--Explanation: The project team members should be involved in the risk identification so that they will develop a sense of ownership and responsibility for the risk events and the associated risk responses. Identify Risks is the process of determining which risks may affect the project. It also documents risks' characteristics. The Identify Risks process is part of the Project Risk Management knowledge area. As new risks may evolve or become known as the project progresses through its life cycle, Identify Risks is an iterative process. The process should involve the project team so that they can develop and maintain a sense of ownership and responsibility for the risks and associated risk response actions. Risk Register is the only output of this process.

Correct answer: Enabling risk-based decision making

D

Correct answer: Operational risk

D--Explanation: Operation risks encompass any potential interruption in business. Operational risks are those risk that are associated with the day-to-day operations of the enterprise. They are generally more detailed as compared to strategic risks. It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. Some sub-categories of operational risks include: • Organizational or management related risks • Information security risks • Production, process, and productivity risks • Profitability operational risks • Business interruption risks . Project activity risks • Contract and product liability risks • Incidents and crisis • Illegal or malicious acts

Correct answer: Communications Management Plan

D--Explanation: The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project.