CA Foundation Business Economics Questions 2023 - Part 32
Fri, 03 Mar 2023
Inspirational journeys
Follow the stories of academics and their research expeditions
CRISC—Certified in Risk and Information Systems Control Certification Questions and answer - Part 60
1. Which of the following is the HIGHEST risk of a policy that inadequately defines data and system ownership?
A) User management coordination does not exists
B) Audit recommendations may not be implemented
C) Users may have unauthorized access to originate, modify or delete data
D) Specific user accountability cannot be established
2. Marie has identified a risk event in her project that needs a mitigation response. Her response actually creates a new risk event that must now be analyzed and planned for. What term is given to this newly created risk event?
A) Residual risk
B) Secondary risk
C) Infinitive risk
D) Populated risk
3. Which one of the following is the only output for the qualitative risk analysis process?
A) Project management plan
B) Risk register updates
C) Organizational process assets
D) Enterprise environmental factors
4. FISMA requires federal agencies to protect IT systems and data. How often should compliance be audited by an external organization?
A) Annually
B) Quarterly
C) Every three years
D) Never
5. Which of the following is the FOREMOST root cause of project risk?Each correct answer represents a complete solution. Choose two.(Select 2answers)
A) New system is not meeting the user business needs
B) Delay in arrival of resources
C) Lack of discipline in managing the software development process
D) Selection of unsuitable project methodology
A) User management coordination does not exists
B) Audit recommendations may not be implemented
C) Users may have unauthorized access to originate, modify or delete data
D) Specific user accountability cannot be established
2. Marie has identified a risk event in her project that needs a mitigation response. Her response actually creates a new risk event that must now be analyzed and planned for. What term is given to this newly created risk event?
A) Residual risk
B) Secondary risk
C) Infinitive risk
D) Populated risk
3. Which one of the following is the only output for the qualitative risk analysis process?
A) Project management plan
B) Risk register updates
C) Organizational process assets
D) Enterprise environmental factors
4. FISMA requires federal agencies to protect IT systems and data. How often should compliance be audited by an external organization?
A) Annually
B) Quarterly
C) Every three years
D) Never
5. Which of the following is the FOREMOST root cause of project risk?Each correct answer represents a complete solution. Choose two.(Select 2answers)
A) New system is not meeting the user business needs
B) Delay in arrival of resources
C) Lack of discipline in managing the software development process
D) Selection of unsuitable project methodology
1. Right Answer: C
Explanation: There is an increased risk without a policy defining who has the responsibility for granting access to specific data or systems, as one could gain system access without a justified business needs. There is better chance that business objectives will be properly supported when there is appropriate ownership.Incorrect Answers:A, B, D: These risks are not such significant as compared to unauthorized access.
2. Right Answer: B
Explanation: Secondary risks are the risks that come about as a result of implementing a risk response. This new risk event must be recorded, analyzed, and planned for management.Incorrect Answers:A: A residual risk event is similar to a secondary risk, but is often small in probability and impact, so it may just be accepted.C: Infinitive risk is not a valid project management term.D: Populated risk event is not a valid project management term.
3. Right Answer: B
Explanation: Risk register update is the only output of the choices presented for the qualitative risk analysis process. The four inputs for the qualitative risk analysis process are the risk register, risk management plan, project scope statement, and organizational process assets. The output of perform qualitative risk analysis process is RiskRegister Updates. Risk register is updated with the information from perform qualitative risk analysis and the updated risk register is included in the project documents. Updates include the following important elements: Relative ranking or priority list of project risks Risks grouped by categories Causes of risk or project areas requiring particular attention List of risks requiring response in the near-term List of risks for additional analysis and response Watchlist of low priority risks Trends in qualitative risk analysis resultsIncorrect Answers:A, C, D: These are not the valid outputs for the qualitative risk analysis process.
4. Right Answer: A
Explanation: Inspection of FISMA is required to be done annually. Each year, agencies must have an independent evaluation of their program. The objective is to determine the effectiveness of the program. These evaluations include: Testing for effectiveness: Policies, procedures, and practices are to be tested. This evaluation does not test every policy, procedure, and practice. Instead, a representative sample is tested. An assessment or report: This report identifies the agency's compliance as well as lists compliance with FISMA. It also lists compliance with other standards and guidelines.Incorrect Answers:B, C, D: Auditing of compliance by external organization is done annually, not quarterly or every three year.
5. Right Answer: C,D
Explanation: The foremost root cause of project risk is: A lack of discipline in managing the software development process Selection of a project methodology that is unsuitable to the system being developedIncorrect Answers:A: The risk associated with new system is not meeting the user business needs is business risks, not project risk.B: This is not direct reason of project risk.
Explanation: There is an increased risk without a policy defining who has the responsibility for granting access to specific data or systems, as one could gain system access without a justified business needs. There is better chance that business objectives will be properly supported when there is appropriate ownership.Incorrect Answers:A, B, D: These risks are not such significant as compared to unauthorized access.
2. Right Answer: B
Explanation: Secondary risks are the risks that come about as a result of implementing a risk response. This new risk event must be recorded, analyzed, and planned for management.Incorrect Answers:A: A residual risk event is similar to a secondary risk, but is often small in probability and impact, so it may just be accepted.C: Infinitive risk is not a valid project management term.D: Populated risk event is not a valid project management term.
3. Right Answer: B
Explanation: Risk register update is the only output of the choices presented for the qualitative risk analysis process. The four inputs for the qualitative risk analysis process are the risk register, risk management plan, project scope statement, and organizational process assets. The output of perform qualitative risk analysis process is RiskRegister Updates. Risk register is updated with the information from perform qualitative risk analysis and the updated risk register is included in the project documents. Updates include the following important elements: Relative ranking or priority list of project risks Risks grouped by categories Causes of risk or project areas requiring particular attention List of risks requiring response in the near-term List of risks for additional analysis and response Watchlist of low priority risks Trends in qualitative risk analysis resultsIncorrect Answers:A, C, D: These are not the valid outputs for the qualitative risk analysis process.
4. Right Answer: A
Explanation: Inspection of FISMA is required to be done annually. Each year, agencies must have an independent evaluation of their program. The objective is to determine the effectiveness of the program. These evaluations include: Testing for effectiveness: Policies, procedures, and practices are to be tested. This evaluation does not test every policy, procedure, and practice. Instead, a representative sample is tested. An assessment or report: This report identifies the agency's compliance as well as lists compliance with FISMA. It also lists compliance with other standards and guidelines.Incorrect Answers:B, C, D: Auditing of compliance by external organization is done annually, not quarterly or every three year.
5. Right Answer: C,D
Explanation: The foremost root cause of project risk is: A lack of discipline in managing the software development process Selection of a project methodology that is unsuitable to the system being developedIncorrect Answers:A: The risk associated with new system is not meeting the user business needs is business risks, not project risk.B: This is not direct reason of project risk.
Tags:
it certification certified it it exams isaca certification isaca cgeit isaca cisa isaca cism isaca cobit 5 isaca crisc isaca questions practice exams pratice quests risc maangement it management it questions isaca answers isaca practice isaca dumps isaca test test questions questins and answer explanation0 Comments
Categories
Recent posts
CA Foundation Business Economics Questions 2023 - Part 31
Fri, 03 Mar 2023
CA Foundation Business Economics Questions 2023 - Part 30
Fri, 03 Mar 2023
Leave a comment