Presentations Risk Assessment & Management 4 — Questions and Answers
Question 1: A cybersecurity analyst is presenting a risk scenario using the STRIDE model. What does the 'T' in STRIDE represent?
- Tampering (Correct answer)
- Tracing
- Threat
- Transfer
Correct answer: Tampering
In the STRIDE threat model, 'T' stands for Tampering, which refers to unauthorized modification of data or systems.
Question 2: During a presentation on operational risk, a manager distinguishes between 'key risk indicators' (KRIs) and 'key performance indicators' (KPIs). What is the primary function of a KRI?
- To provide early warning signals of increasing risk exposure (Correct answer)
- To measure whether business goals are being achieved
- To document risks that have already been realized
- To track the cost of risk mitigation activities
Correct answer: To provide early warning signals of increasing risk exposure
KRIs are forward-looking metrics that signal when risk levels are rising, allowing proactive intervention before an incident occurs.
Question 3: A risk presentation explains the concept of a 'bow-tie' diagram. What does the left side of the bow-tie represent?
- Causes and preventive controls leading to the risk event (Correct answer)
- Consequences and recovery controls after the event
- Residual risks after mitigation
- Stakeholder communication pathways
Correct answer: Causes and preventive controls leading to the risk event
The left side of a bow-tie diagram maps threats and preventive barriers that stop the risk event from occurring.
Question 4: In a risk presentation for a construction project, the speaker refers to 'force majeure.' What type of risk does this term describe?
- Unforeseeable external events beyond any party's control (Correct answer)
- Risks arising from contractor negligence
- Budget overruns due to scope creep
- Regulatory compliance failures
Correct answer: Unforeseeable external events beyond any party's control
Force majeure refers to extraordinary events—such as natural disasters or wars—that are beyond the control of any contracting party.
Question 5: When presenting a risk communication plan, which principle is MOST important for conveying risk information to a general public audience?
- Use plain language and avoid technical jargon (Correct answer)
- Present all quantitative data in its full statistical detail
- Focus exclusively on worst-case scenarios
- Limit communication to written reports only
Correct answer: Use plain language and avoid technical jargon
Effective risk communication to non-expert audiences requires clear, accessible language free of technical terminology to ensure comprehension.
Question 6: A risk consultant presents a 'risk breakdown structure' (RBS). How does an RBS differ from a standard risk register?
- An RBS organizes risks hierarchically by category, while a register lists individual risks (Correct answer)
- An RBS quantifies risks financially, while a register only qualifies them
- An RBS is used only for qualitative analysis, while a register is quantitative
- An RBS tracks risk owners, while a register tracks mitigation costs
Correct answer: An RBS organizes risks hierarchically by category, while a register lists individual risks
A Risk Breakdown Structure (RBS) arranges risk sources into hierarchical categories, giving a structured view of where risks originate.
Question 7: A financial analyst presenting stress test results explains that the test simulates extreme but plausible scenarios. What is the PRIMARY goal of stress testing in risk management?
- To evaluate how a portfolio or system performs under severe adverse conditions (Correct answer)
- To identify the most likely risk to occur in normal operating conditions
- To calculate the average expected loss across all risk scenarios
- To satisfy regulatory reporting requirements without actionable insight
Correct answer: To evaluate how a portfolio or system performs under severe adverse conditions
Stress testing assesses resilience by measuring the impact of extreme but realistic adverse scenarios on an organization or portfolio.
Presentations Risk Assessment & Management 4
A cybersecurity analyst is presenting a risk scenario using the STRIDE model.
What does the 'T' in STRIDE represent?