IT Risk Assessment Techniques Flashcards
6 cards from real CRISC practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 6 IT Risk Assessment Techniques flashcards as text
Which risk assessment technique uses historical data and probability distributions to simulate thousands of possible risk scenarios?
Answer: Monte Carlo simulation
Monte Carlo simulation runs large numbers of probabilistic simulations based on historical data to estimate the range of possible risk outcomes.
In a qualitative risk assessment, risks are PRIMARILY evaluated using:
Answer: Descriptive scales such as High, Medium, and Low
Qualitative risk assessment uses descriptive scales rather than numerical values to rate likelihood and impact of risks.
The PRIMARY advantage of quantitative risk assessment over qualitative is:
Answer: It provides dollar-value estimates that support financial decision-making
Quantitative risk assessment produces financial estimates (e.g., ALE) that directly support cost-benefit analysis and budget decisions.
Which formula correctly represents Annualized Loss Expectancy (ALE)?
Answer: ALE = SLE × ARO
ALE is calculated by multiplying Single Loss Expectancy (SLE) by the Annualized Rate of Occurrence (ARO) to estimate annual risk cost.
A threat-vulnerability pairing is used in risk assessment to determine:
Answer: The likelihood that a specific threat will exploit a given vulnerability
Pairing threats with vulnerabilities helps assessors determine the probability that a specific threat source will successfully exploit an existing weakness.
Which risk assessment approach is MOST appropriate when limited historical data is available?
Answer: Qualitative assessment using expert judgment
Qualitative assessment using expert judgment is most practical when historical data is insufficient for statistical or quantitative analysis.