CGRC Risk Assessment and Management 4

Question 1

An Annualized Loss Expectancy (ALE) is calculated as:

Accepted Answer

Single Loss Expectancy × Annualized Rate of Occurrence

Answer

ALE = SLE × ARO; it represents the expected annual monetary loss from a specific threat given how often that threat is expected to occur.

Question 2

Which risk assessment approach is MOST appropriate when precise data is unavailable but expert judgment can be gathered?

Accepted Answer

Qualitative risk assessment

Answer

Qualitative risk assessment uses expert judgment and descriptive scales (High/Medium/Low) when hard data is unavailable or cost-prohibitive to gather.

Question 3

A risk owner is PRIMARILY responsible for:

Accepted Answer

Accepting, mitigating, or transferring risks within their area

Answer

A risk owner is accountable for managing a specific risk, including deciding on treatment options within their domain and monitoring outcomes.

Question 4

Which of the following BEST distinguishes risk tolerance from risk appetite?

Accepted Answer

Risk appetite is the strategic willingness to accept risk; risk tolerance is the acceptable variance around that level

Answer

Risk appetite is the overall desired level of risk, while risk tolerance defines the acceptable deviation above or below that appetite in practice.

Question 5

An organization performs a threat analysis and finds that employees are the most frequent source of incidents. This category of threat source is called:

Accepted Answer

Insider threat

Answer

Insider threats originate from current or former employees, contractors, or business partners who misuse authorized access, whether maliciously or accidentally.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Risk Assessment and Management 4