Risk Assessment & Business Impact Analysis Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Business Impact Analysis flashcards as text
Which qualitative risk analysis technique uses a predefined scale (e.g., Low/Medium/High) to rate both likelihood and impact?
Answer: Risk matrix (heat map)
A risk matrix plots likelihood against impact using categorical scales to produce a visual risk heat map.
What distinguishes a 'threat' from a 'vulnerability' in the context of risk assessment?
Answer: A threat is the potential cause of harm; a vulnerability is a weakness that can be exploited
Threats are potential harmful events or actors, while vulnerabilities are weaknesses in assets or controls that threats can exploit.
During a BIA, which of the following is considered a non-financial impact category?
Answer: Reputational damage and customer confidence erosion
Reputational damage is a non-financial (intangible) impact that must be captured alongside quantifiable financial losses.
Which risk assessment method uses expert elicitation and Delphi techniques to reach consensus on risk ratings?
Answer: Qualitative risk analysis
Qualitative risk analysis relies on expert judgment and structured techniques like Delphi to assign categorical ratings when hard data is unavailable.
An organization's critical process has an RPO of 4 hours. Which backup strategy BEST meets this requirement?
Answer: Continuous data replication with near-real-time synchronization
Continuous replication minimizes data loss to seconds or minutes, easily satisfying a 4-hour RPO.
Which BIA component identifies the minimum staffing level and resources needed to resume a critical function?
Answer: Minimum Business Continuity Objective (MBCO)
MBCO specifies the minimum level of service that must be maintained or restored to satisfy business obligations during a disruption.
A risk that has been identified, evaluated, and deliberately left in place without additional controls is said to be:
Answer: Accepted risk
Accepted risk is a documented decision to retain a risk because the cost of treatment exceeds the expected impact.