Risk Assessment & Business Impact Analysis Flashcards
7 cards from real CRP practice questions. Tap to flip, then mark Knew It or Still Learning — missed cards come back until you master them.
Read the first 7 Risk Assessment & Business Impact Analysis flashcards as text
When conducting a supply chain risk assessment, which technique maps upstream and downstream dependencies to identify single points of failure?
Answer: Dependency mapping / supply chain mapping
Dependency mapping visualizes all upstream suppliers and downstream customers to expose critical single points of failure in the supply chain.
Which element of a BIA report directly informs the selection and sizing of recovery strategies?
Answer: Prioritized list of critical functions with RTO and RPO
The prioritized function list with RTOs and RPOs drives decisions about what recovery capabilities must be built and at what speed.
An organization experiences a cyberattack every three years on average and each attack costs $900,000. What is the ALE?
Answer: $300,000
ALE = SLE × ARO = $900,000 × (1/3) = $300,000 per year.
Which risk scenario planning technique asks 'What could go wrong if a specific control fails?' to stress-test recovery plans?
Answer: Failure Mode and Effects Analysis (FMEA)
FMEA systematically evaluates each component and its potential failure modes to determine effects on the overall process.
A BIA conducted three years ago is being used to set recovery priorities for a new cloud migration project. What is the PRIMARY concern?
Answer: Business processes may have changed significantly, making the BIA inaccurate
BIAs must be regularly reviewed and updated because process changes, new products, or restructuring can alter criticality and recovery requirements.
Which risk treatment is MOST appropriate when the cost to mitigate a risk significantly exceeds the asset's value?
Answer: Risk acceptance
When mitigation costs outweigh potential losses, accepting the risk is the economically rational decision.
In a bow-tie risk analysis, what does the 'left side' of the diagram represent?
Answer: Threat sources and preventive controls before the top event
The left side of a bow-tie diagram shows threats (causes) and the prevention barriers that stop them from reaching the central hazard event.