Which of the following is the PRIMARY reason to update a risk register with risk assessment results?
Correct Answer: D
Question 7
Who is responsible for IT security controls that are outsourced to an external service provider?
Correct Answer: B
Question 8
Which types of controls are BEST used to minimize the risk associated with a vulnerability?
Correct Answer: B
Preventive controls are the best types of controls to minimize the risk associated with a vulnerability, because they aim to avoid or reduce the occurrence of a threat or an exploit. Preventive controls can include physical, technical, or administrative measures, such as locks, firewalls, encryption, policies, training, or backup. Preventive controls can also involve eliminating or substituting the source of the vulnerability, such as outdated software or hardware. References *ISACA CRISC Review Manual, 7th Edition, Domain 3: Risk Response, Section 3.2.1: Control Types *Hazard Controls - Princeton University *Risk Control | Techniques and Importance of Risk Control - EDUCBA
Question 9
Which of the following statements in an organization's current risk profile report is cause for further action by senior management?
Correct Answer: B
Question 10
You work as a Project Manager for www.company.com Inc. You have to measure the probability, impact, and risk exposure. Then, you have to measure how the selected risk response can affect the probability and impact of the selected risk event. Which of the following tools will help you to accomplish the task?
Correct Answer: C
Section: Volume B Explanation: Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks and opportunities connected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility. Incorrect Answers: A: Project network diagrams help the project manager and stakeholders visualize the flow of the project work, but they are not used as a part of risk response planning. B: The Delphi technique can be used in risk identification, but generally is not used in risk response planning. The Delphi technique uses rounds of anonymous surveys to identify risks. D: Cause-and-effect diagrams are useful for identifying root causes and risk identification, but they are not the most effective ones for risk response planning.
