CRISC IT Risk Assessment Techniques

Question 1

Which risk assessment technique uses historical data and probability distributions to simulate thousands of possible risk scenarios?

Accepted Answer

Monte Carlo simulation

Answer

Delphi technique

Answer

Bowtie analysis

Answer

SWOT analysis

Question 2

In a qualitative risk assessment, risks are PRIMARILY evaluated using:

Accepted Answer

Descriptive scales such as High, Medium, and Low

Answer

Dollar value of potential losses

Answer

Statistical probability distributions

Answer

Return on security investment calculations

Question 3

The PRIMARY advantage of quantitative risk assessment over qualitative is:

Accepted Answer

It provides dollar-value estimates that support financial decision-making

Answer

It is faster to perform and requires less data

Answer

It eliminates subjectivity completely from the process

Answer

It is easier to communicate to non-technical stakeholders

Question 4

Which formula correctly represents Annualized Loss Expectancy (ALE)?

Accepted Answer

ALE = SLE × ARO

Answer

ALE = AV × EF + ARO

Answer

ALE = ARO / SLE

Answer

ALE = SLE + ARO

Question 5

A threat-vulnerability pairing is used in risk assessment to determine:

Accepted Answer

The likelihood that a specific threat will exploit a given vulnerability

Answer

The total cost of implementing a security control

Answer

The organizational risk appetite for IT risks

Answer

The residual risk after controls are applied

Question 6

Which risk assessment approach is MOST appropriate when limited historical data is available?

Accepted Answer

Qualitative assessment using expert judgment

Answer

Quantitative assessment using actuarial data

Answer

Monte Carlo simulation

Answer

Regression analysis