MAY2024 RISK MGT

Multiple Choice

The aim of risk identification is to identify possible risks that may affect, either negatively or positively, the objectives of the business and the activity under

analysis.

• True

• False

Multiple Choice

The first step is to analyse potential risks that could impact the project or organisation.

• True

• False

Multiple Choice

The first step is to analyse potential risks that could impact the project or organisation

• True

• False

Multiple Choice

Once risks have been identified, they need to be analysed to determine their likelihood and potential impact.

• True

• False

Multiple Choice

After analysing the risks, they need to be evaluated to determine which ones require further attention.

• True

• False

Multiple Choice

The final step is to communicate the risk management process and consult on its effectiveness.

• True

• False

Multiple Choice

Risk management is a collaborative process and communication is essential to its success.

• True

• False

Multiple Choice

The fourth step is to treat the identified risks by implementing mitigation measures or developing contingency plans.

• True

• False

Multiple Choice

Risk assessment evaluates the relative risk for each vulnerability

• True

• False

Multiple Choice

A company is expanding its operations to a new country with different legal and regulatory requirements. What activity should they prioritize?

• Risk analysis

• Risk acceptance

• Risk assessment

• Risk mitigation

Multiple Choice

A new software application is being developed, and the development team wants to ensure that security vulnerabilities are identified and addressed early in the process. What activity should they prioritize?

• Risk analysis

• Risk acceptance

• Risk assessment

• Risk mitigation

Multiple Choice

A new regulatory requirement has been introduced, mandating stricter data protection measures. What activity should they prioritize?

• Risk analysis

• Risk acceptance

• Risk assessment

• Risk mitigation

Multiple Choice

An employee accidentally clicked on a malicious link in an email, resulting in a malware infection on their computer. What activity should they prioritize?

• Risk analysis

• Risk acceptance

• Risk assessment

• Risk mitigation

Multiple Choice

Which of the following is not accurate regarding the process of risk management?

• The likelihood of a threat must be determined as an element of the risk assessment.

• The level of impact of a threat must be determined as an element of the risk assessment.

• Risk assessment is the first process in the risk management methodology.

• Risk assessment is the result of the risk management methodology

Reorder

Reorder the following steps in Risk Management Cycle in business setting

• Identify Risks

• Analyse risks

• Evaluate Risks

• Mitigate risks

1

2

3

4

• 1
• 2
• 3
• 4

Reorder

Reorder the following steps in Risk Management Cycle in business setting starting from step 5

• Monitor and review

  risks

• Communicate and consult risks

• Record and Report

1

2

3

• 1
• 2
• 3

Match

Match the following

• A construction project may identify risks such as weather delay or labour shortage

• A construction project may identify risks such as weather delay or labour shortage

• A construction project may identify risks such as weather delay or labour shortage

Identify Risks

Analyse Risks

Evaluate Risks

• Identify Risks

• Analyse Risks

• Evaluate Risks

Multiple Choice

Risk identification is the process of identify and assess ____________.

• Threats

• Operation

• Organisation

• Workforce

Multiple Choice

The ai of risk identification is to _______________.

• Give mental support for staff.

• Identify possible risks.

• Boost staff morale.

• Give physical support to an organisation.

Multiple Choice

Risks should be continuously monitored and reviewed to ensure that

____________are effective.

• New risks

• Mitigation measures

• Evaluation measures

• Identification measures

Match

Match the following

• project team may mitigate the risk of resource constraints by cross-training team members or by hiring additional staff.

• project team may regularly review the status of the project's schedule and budget to identify potential resource constraints.

• project manager may communicate the status of the project's schedule and budget to stakeholders and consult with them on potential mitigation strategies.

• project team may maintain records of its risk assessments and mitigation measures to demonstrate compliance with quality standards or regulatory requirements.

Mitigate Risk

Monitor and Review Risk

Communicate and Consult

Record and Report

• Mitigate Risk

• Monitor and Review Risk

• Communicate and Consult

• Record and Report

​mitigation
strategies

Multiple Choice

A company is considering outsourcing its data storage to a third-party cloud provider. What risk management strategy should they consider implementing?

• Risk acceptance

• Risk avoidance

• Risk mitigation

• Risk transference

Multiple Choice

A company's physical office space is located in an area prone to natural disasters, such as hurricanes and earthquakes. What risk management strategy should they consider implementing?

• Risk acceptance

• Risk avoidance

• Risk mitigation

• Risk transference

Multiple Choice

A company has identified a significant security vulnerability in its network infrastructure. However, the cost of implementing the necessary controls to

mitigate the risk is too high. What risk management strategy should they consider implementing?

• Risk acceptance

• Risk avoidance

• Risk mitigation

• Risk transference

Multiple Choice

How many Risk Mitigation strategies are there?

• 1

• 2

• 5

• 6

Match

Match the following risk mitigation strategies

• reduce amount of risk

• bank establish several branches

• insurance

• aware and avoid actions causing risk

• aware and put controls

reduce

redistribution

transfer

avoidance

acceptance

• reduce

• redistribution

• transfer

• avoidance

• acceptance

Reorder

Reorder the following steps in risk management process as followed by

enforcement agencies

• IDENTIFY HAZARDS

• ASSESS HAZARDS

• DEVELOP CONTROLS AND MAKE A RISK DECISION

• IMPLEMENT CONTROL

• SUPERVISE AND EVALUATE

1

2

3

4

5

• 1
• 2
• 3
• 4
• 5

Multiple Choice

In the first step, identifying hazards, law enforcement agencies should also

consider _____________.

• Time available for execution

• Public holidays available

• Interest of the members

• Attraction levels of members

Multiple Choice

Probability determines ___________.

• How bad a situation could be

• Whether a situation is categorised as high or low risk

• How severe a risk is

• Likelihood that a hazard may cause a problem

Multiple Choice

Severity asks: _______________________________?

• How bad could it be?

• How beautiful it is?

• How annoying it is?

• How irritating could it be?

Multiple Choice

Which of the following steps demands ‘analysis judgement’?

• Develop control and make risk decision.

• Assess risk.

• Identify risk.

• Implement control.

Multiple Choice

Enforce controls and evaluate soldiers understanding of standards. This

refers to ____________.

• Supervise and Evaluate

• Identify risk.

• Evaluate risk.

• D. Implement risk control

Multiple Choice

Retrospective risk analysis typically involves collecting historical data to identify patterns and trends in past risk events

• True

• False

Multiple Choice

Retrospective risk analysis involves evaluating potential future risks based on current data and trends

• True

• False

Multiple Choice

Retrospective risks are those that will occur in the future.

• True

• False

Multiple Choice

Retrospective risk identification is often the most common way to identify risk and the easiest. It’s easier to believe something if it has happened before.

• True

• False

Fill in the Blank

______ risks are risks that happened already.

Multiple Choice

Retrospective risk identification is _______________.

• Hardest way to identify risk.

• Easiest way to identify risk.

• Complicated way to identify risk.

• Useless way to identify risk

Multiple Choice

Investigating the reasons for a project's budget overrun that occurred last year is an example of prospective risk analysis.

• True

• False

Multiple Choice

Prospective risk analysis is not useful for developing risk mitigation strategies.

• True

• False

Multiple Choice

Prospective risks are often harder to identify.

• True

• False

Multiple Choice

Prospective risk analysis involves evaluating potential future risks based on current data and trends

• True

• False

Fill in the Blank

Potential risks that may happen in the future. This refers to _________ risks.

Multiple Choice

Since prospective risks have not happened, they are __________ to identify.

• Difficult

• Easy

• Complicated

• Unchallenging

Multiple Choice

Which of the following is NOT a method of identifying prospective risks.

• Brainstorming

• Conducting interview

• Undertaking survey

• Monitor patterns and past history

Multiple Choice

Everyone talking at the same time is one of the ways brainstorming.

• True

• False

Multiple Choice

How many rules are there in brainstorming?

• 1

• 7

• 9

• 10

Multiple Choice

Which of the following is NOT a rule of brainstorming?

• Stay focused on the topic.

• Be visual.

• Go for quantity.

• Judge the idea of others.

Multiple Choice

22. What is the difference between quantitative and qualitative risk analysis?

• Qualitative analysis uses mathematical formulas and while quantitative analysis does not.

• Purely qualitative analysis is not possible, while purely quantitative is possible

• Quantitative analysis provides formal cost/benefit information while qualitative analysis does not.

• There is no difference between qualitative and quantitative analysis.

Multiple Choice

The techniques for risk assessment in organization will be used?

• Assessment risks

• Countermeasure assessment

• Qualitive and quantitative

• Completely avoid risk

Multiple Choice

What the component of typical risk assessment method?

• Identify risks

• Countermeasure assessment

• Reduce risk to an acceptable level

• Completely avoid risk

Multiple Choice

How many components are there in risk assessment?

• 1

• 2

• 3

• 4

Multiple Choice

The outcome of the asset valuation process is a figure, which can be used to determine the priority or level of protection needed for each asset.

• True

• False

Multiple Choice

Things like computer hardware, retail inventory, manufacturing facilities are called tangible assets.

• True

• False

Multiple Choice

How many types of assets are there?

• 1

• 2

• 3

• 4

Multiple Choice

Critical data, good repetition or proprietary training material. These are the

examples of ____________.

• Tangible asset

• Intangible asset

• Touchable asset

• Untouchable asset

Multiple Choice

28. Intangible assets need protection even if ________________.

• They are broken

• They are unattainable

• They do not take up physical space

• They are useless

Multiple Choice

Licensing agreement, service contracts and leases are ____________ assets.

• Brand related.

• Contract related

• Customer related

• Building related

Multiple Choice

Cash, land and machines are the examples of ____________ assets.

• Brand related.

• Contract related

• Customer related

• Building related

Multiple Choice

Assigning a risk rating score to each asset. This refers to __________.

• Threat assessment

• Vulnerability assessment

• Counter measure assessment

• Threat identification

Multiple Choice

How can customer data manipulation be counter measured?

• Dynamic credentials

• Digital Signature

• Encryption

• Web application scanners

Multiple Choice

Dynamic credentials are the perfect counter measure for ___________ risk.

• Data leakage

• Customer data leakage

• Malicious VM

• Account / Service hijacking

Multiple Choice

Realistic threats need _____________; unimportant threats are _____________.

• Investigation; set aside

• Representation; ignored

• Ignored; set aside

• Investigation; prioritised

Multiple Choice

A company is developing a mobile application that will handle sensitive user data. What security control should be implemented to ensure secure data storage on the users' devices?

• Encryption

• Access control mechanisms

• Incident response plan

• Security awareness training

Multiple Choice

A company is evaluating two different security control options to protect their network: a firewall and an intrusion detection system. Which type of control should they prioritize if they want to identify and respond to potential security breaches in real-time?

• Firewall

• Intrusion detection system

• Both should be implemented

• Neither option is effective for real-time detection

Multiple Choice

Unimportant threats need investigation; realistic threats are set aside.

• True

• False