CGRC Risk Assessment and Management 2

Question 1

Which risk assessment methodology uses probability and impact ratings to calculate a risk score?

Accepted Answer

Semi-quantitative risk assessment

Answer

Semi-quantitative risk assessment combines numerical scales for probability and impact to produce a risk score without requiring precise monetary values.

Question 2

A company identifies that a vendor handling PII could be breached. This scenario best represents which risk concept?

Accepted Answer

Third-party risk

Answer

Third-party risk refers to the potential for harm arising from a vendor, supplier, or partner relationship where sensitive data or processes are involved.

Question 3

In NIST SP 800-30, which step immediately follows risk identification?

Accepted Answer

Risk analysis

Answer

NIST SP 800-30 defines the risk management process as: framing, assessing (identify then analyze), responding, and monitoring — so analysis follows identification.

Question 4

An organization determines that the cost of a control exceeds the potential loss it would prevent. The BEST action is to:

Accepted Answer

Accept the residual risk

Answer

When control costs exceed potential losses, accepting the residual risk is the rational response based on cost-benefit analysis.

Question 5

Which of the following BEST describes the concept of risk appetite?

Accepted Answer

The amount of risk an organization is willing to accept in pursuit of objectives

Answer

Risk appetite is the broad-based amount of risk an organization is willing to accept in pursuit of its mission and strategic goals.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Assessment and Management 2