ISACA CRISC Practice Questions with Explanations

Correct answer: D

Key Risk Indicators must be maintained because the risk landscape is dynamic-threats and vulnerabilities continuously evolve due to changing business environments, technological advancements, regulatory shifts, and emerging attack vectors. Static KRIs become obsolete and fail to provide meaningful early warning signals. While timeliness and metrics refinement are important, the fundamental reason for ongoing maintenance is that risks themselves change over time, necessitating updated indicators to remain effective.

Why the other options are wrong:

• A. Avoiding risk entirely is unrealistic; KRIs are designed to monitor and manage risk, not eliminate it.
• B. Fine-tuning metrics is a process detail, not the primary reason for KRI maintenance.
• C. Timeliness of reports is important but is a consequence of good KRI maintenance, not the main reason for it.

Correct answer: C

During project closure and administrative activities, successful risk responses that were identified and implemented during monitoring and controlling should be captured in the organization's lessons learned database. This preserves institutional knowledge for future projects and allows the organization to benefit from the innovative methods developed to handle similar risks. While the risk register documents what happened, lessons learned capture the insights and effective practices that should inform future project management. This is a best practice for organizational learning and continuous improvement.

Why the other options are wrong:

• A. The project management plan is developed during planning phases and should not be retroactively updated with execution-phase discoveries.
• B. Risk responses are managed through the risk register during execution; the risk management plan is a planning document.
• D. Although responses are in the risk register, the critical step is extracting and documenting them as organizational lessons learned for future use.

Correct answer: D

A risk event that could save $100,000 is not a threat but an opportunity-a positive risk event. In risk management terminology, opportunities should be exploited (maximized and actively pursued) to capture their potential benefits. This aligns with the three response strategies for opportunities: exploit, enhance, or share. Mitigation and avoidance are defensive strategies appropriate for threats, while acceptance is passive. Exploitation is the proactive strategy that directly captures the $100,000 savings.

Why the other options are wrong:

• A. Mitigation is a threat response strategy used to reduce negative impact, not to capture positive benefits.
• B. Acceptance is passive; it means tolerating the risk without action, which fails to actively pursue the opportunity.
• C. Avoidance eliminates risk but would prevent the opportunity from being realized, negating the potential $100,000 savings.

Correct answer: C

Risk identification is not a one-time activity; it must be conducted iteratively throughout the project lifecycle because new risks emerge as the project progresses. Changes in project scope, environment, resources, stakeholder composition, and external factors continuously introduce previously unknown risks. Scheduling multiple risk identification sessions allows the project team to discover and address these newly identified risks before they materialize into problems. This proactive approach is essential for comprehensive risk management across all project phases.

Why the other options are wrong:

• A. While stakeholder participation is valuable, increased meetings do not primarily serve this purpose-proper planning can achieve participation without repetition.
• B. Discussing risks that have already passed is retrospective analysis, not the primary reason for scheduling future risk sessions.
• D. Communicating pending risks is important but is a secondary purpose; the primary reason is identifying new risks as conditions change.

Correct answer: A

The Risk Priority Number (RPN) is calculated by multiplying occurrence, severity, and detection ratings: RPN = Occurrence × Severity × Detection = 4 × 5 × 6 = 120. This multiplicative approach prioritizes risks that are likely to occur, have high impact, and are difficult to detect-all factors that elevate overall risk criticality. The RPN provides a numerical ranking tool to prioritize which risks deserve the most attention and resources in the risk management plan.

Why the other options are wrong:

• B. 100 results from an incorrect calculation not reflecting the multiplication of all three factors.
• C. 15 represents only partial calculations (e.g., 4+5+6 divided by 2), not the correct RPN formula.
• D. 30 is far too low and does not result from the correct multiplication of 4 × 5 × 6.

Correct answer: B

The most important use of Key Risk Indicators is providing early warning signals of emerging or escalating risks before they materialize into actual problems. KRIs are forward-looking metrics designed to detect risk triggers and adverse trends in real-time, enabling management to take proactive corrective actions. This early warning capability is the fundamental value proposition of KRIs-they allow organizations to intervene before risks crystallize into incidents that impact operations, strategy, or stakeholders.

Why the other options are wrong:

• A. Providing a backward-looking view describes risk reporting and incident analysis, not the forward-looking nature of KRIs.
• C. Indicating risk appetite and tolerance is a governance function, not the primary operational use of KRIs.
• D. While documentation and trend analysis are important, they are secondary uses; the primary purpose is enabling proactive early intervention.

Correct answer: D

The communications management plan documents stakeholder information needs and requirements: who needs what information, when they need it, in what format, and who is responsible for providing and receiving it. When several risks will affect multiple stakeholder requirements, this plan is the document that identifies which people are available and designated to share risk information with each stakeholder group.

Why the other options are wrong:

• A. The resource management plan addresses acquiring, developing and releasing team and physical resources, not information-sharing responsibilities.
• B. The risk management plan describes how risk management will be conducted (methodology, roles for risk activities, categories, thresholds), not the detailed communication channels and who shares information with stakeholders.
• C. The stakeholder management strategy analyzes stakeholder interest, influence and engagement approaches, but the specific communication assignments come from the communications plan.

Correct answer: B

Physical security is a non-technical control that involves physical measures like locks, surveillance cameras, access cards, and facility design to protect assets and information. Access control, intrusion detection systems, and encryption are all technical controls that rely on technology and systems to implement security measures.

Why the other options are wrong:

• A. Access control is a technical control implemented through systems, permissions, and authentication mechanisms.
• C. Intrusion detection system is a technical control that uses technology to monitor and detect unauthorized access.
• D. Encryption is a technical control that uses algorithms and cryptographic methods to protect data.

Correct answer: D

Decision tree diagrams are used primarily for risk response planning and quantitative risk analysis to evaluate decision alternatives and their outcomes, not for identifying and diagramming potential risks during risk identification. Process flowcharts, Ishikawa (fishbone) diagrams, and influence diagrams are all standard tools used in risk identification to visualize and understand potential sources and relationships of risks.

Why the other options are wrong:

• A. Process flowcharts are used to identify risks by mapping process steps and potential failure points.
• B. Ishikawa diagrams are specifically used to identify root causes and potential risks affecting a project.
• C. Influence diagrams are used to show relationships and dependencies between variables and potential risk factors.

Correct answer: B

In risk management context, the utility of a risk refers to the potential opportunity or benefit that can arise from the risk event. This concept recognizes that risks can have positive outcomes (opportunities) in addition to negative consequences (threats). Understanding the potential opportunity side of a risk helps in developing response strategies that might capitalize on favorable outcomes.

Why the other options are wrong:

• A. Finance incentive is not the standard definition of risk utility; it's too narrow and focuses only on financial aspects.
• C. The mechanics of how a risk works describes risk causation or trigger conditions, not utility.
• D. Usefulness to individuals or groups is too vague and doesn't capture the concept of potential opportunity inherent in risk utility.

Correct answer: A

Scalability is the aspect of a monitoring tool that ensures it can grow and adapt to handle increased data volume, more monitored systems, and expanding enterprise infrastructure without degradation of performance. This is critical as enterprises grow and their monitoring needs increase significantly over time.

Why the other options are wrong:

• B. Customizability refers to the ability to tailor the tool to specific needs, not its ability to handle growth.
• C. Sustainability relates to long-term viability and support, not the ability to keep up with enterprise growth.
• D. Impact on performance is a measurement concern but not the aspect that ensures growth capability.

Correct answer: B

A risk that represents a noticeable failure threatening the success of certain goals of the enterprise is classified as a high risk. The description indicates a significant threat to enterprise objectives with a notable impact, which aligns with the definition of high-risk level-risks that could substantially compromise project or enterprise success if they occur.

Why the other options are wrong:

• A. Moderate risk would not represent a noticeable failure threatening success; it would be less severe.
• C. Extremely high risk would suggest an existential threat to the entire enterprise, not just certain goals.
• D. Low risk would not threaten the success of goals in any noticeable way.

Correct answer: B

The primary advantage of grouping identified risks by common causes during qualitative risk analysis is that it assists in developing effective risk responses. By identifying that multiple risks share the same underlying cause, the project team can develop a single, comprehensive response strategy that addresses the root cause rather than treating each symptom individually. This leads to more efficient and effective risk management.

Why the other options are wrong:

• A. While grouping may help identify high-risk areas, the primary advantage is in response development, not area identification.
• C. Time savings is a secondary benefit; the primary advantage focuses on response effectiveness.
• D. Creating unique risk categories is not the main purpose; the focus is on analysis and response strategy development.

Correct answer: D

Risk communication is the process of exchanging information and views about risks among stakeholders, including groups, individuals, and institutions. This process ensures that risk information is shared transparently and that all relevant parties understand the risks and can contribute to risk management discussions and decisions.

Why the other options are wrong:

• A. Risk governance addresses the structure, authority, and oversight of risk management, not the exchange of information.
• B. Risk identification is the process of finding and documenting risks, not exchanging views about them.
• C. Risk response planning develops strategies to address risks, not the exchange of information and views.

Correct answer: A

The Risk Register is the primary output of the risk identification process where the project manager meets with team members and stakeholders to identify and document project risks. It serves as a comprehensive repository of all identified risks, their descriptions, and initial assessments. The Risk Management Plan is developed before risk identification, the Risk Breakdown Structure is a supporting tool rather than a primary output, and Risk Categories are components used to organize risks rather than standalone outputs.

Why the other options are wrong:

• B. The Risk Management Plan is created during risk management planning, which occurs before the identification process.
• C. The Risk Breakdown Structure is a supporting tool used to categorize risks, not the key output of identification.
• D. Risk Categories are used to classify risks within the Risk Register, not a primary output themselves.

Correct answer: D

Actors are the entities or agents within risk scenarios that have the capability and motivation to generate threats against an enterprise. They represent the threat sources- whether internal (disgruntled employees, negligent staff) or external (competitors, cybercriminals, hackers)-that can cause harm. Events describe what happens, timing indicates when, and assets are what is at risk, but none of these components inherently generate threats; rather, actors are the originators of threats.

Why the other options are wrong:

• A. Timing dimension specifies when a threat occurs, not what generates it.
• B. Events describe the occurrence of a threat scenario but do not themselves generate threats.
• C. Assets are the targets of threats but do not generate threats themselves.

Correct answer: C

Before relying on any controls implemented in the risk response process, it is essential to conduct pilot testing to validate that the controls function as designed and effectively mitigate the identified risks. Pilot testing ensures controls are reliable and suitable before full implementation across the project. Reviewing performance data, discovering risk exposure, and articulating risk are either preliminary activities or ongoing monitoring tasks rather than prerequisites to relying on controls.

Why the other options are wrong:

• A. Reviewing performance data occurs during monitoring and control, not before implementing controls.
• B. Discovering risk exposure is part of the initial risk assessment, not a prerequisite for control implementation.
• D. Articulating risk is part of the identification and analysis phase, completed before implementing controls.

Correct answer: A

At Capability Maturity Level 1 (Initial), risk management is ad hoc and reactive rather than well-established. The statement in option A describes a more mature perspective where both business and technical aspects of risk are recognized as important. At Level 1, decisions lack credible risk information (B is true), risk assessments are episodic rather than continuous (C is true), and risk management skills are undeveloped and ad hoc (D is true). Option A contradicts the actual characteristics of Level 1, making it the correct answer to 'NOT true'.

Why the other options are wrong:

• B. Decisions at Level 1 do lack credible information-this is a true characteristic of this immature level.
• C. Risk appetite and tolerance are only applied episodically at Level 1-this is a true characteristic.
• D. Risk management skills are indeed ad hoc and not actively developed at Level 1- this is a true characteristic.

Correct answer: D

Business managers are the most important stakeholders for reviewing risk response options to IT risks because they understand the business impact and strategic implications of both the risks and the proposed responses. They ensure that risk responses align with business objectives, are cost-effective, and do not create conflicting constraints. While information security managers, internal auditors, and incident response team members provide valuable technical and compliance perspectives, business managers are ultimately responsible for balancing risk against business priorities.

Why the other options are wrong:

• A. Information security managers provide technical security expertise but lack the broader business perspective needed for final response decisions.
• B. Internal auditors provide compliance and control assurance but are not primarily responsible for operational risk response decisions.
• C. Incident response team members execute response plans but are not the primary reviewers of response strategy options.

Correct answer: C

Fault Tree Analysis is a systematic technique that provides a structured description of how combinations of unwanted component failures and external events can combine to cause a specified undesired event (system failure). It uses a deductive approach to trace root causes. Sensitivity analysis measures how outputs change with input variations, scenario analysis examines specific future situations, and cause and effect analysis (fishbone diagrams) identifies contributing factors but does not systematically combine failures like fault tree analysis does.

Why the other options are wrong:

• A. Sensitivity analysis examines how changes in variables affect outcomes, not how combinations of failures occur.
• B. Scenario analysis explores specific hypothetical situations but does not systematically map combinations of failures.
• D. Cause and effect analysis identifies relationships between factors but lacks the systematic failure combination logic of fault trees.

Correct answer: A

Risk Treatment is the formal term for the process of selecting and implementing measures to mitigate, avoid, transfer, or accept identified risks and their impacts. It encompasses the strategic and tactical decisions about how to respond to risks and the implementation of those responses. Control refers to specific mechanisms that manage risk, Risk Assessment is the analysis of identified risks, and Risk Management is the broader process of which treatment is one component.

Why the other options are wrong:

• B. Control is a specific mechanism or tool used to manage risk, not the overall process of selecting response measures.
• C. Risk Assessment is the process of evaluating risks, not selecting and implementing response measures.
• D. Risk Management is the umbrella process of which treatment is a subset component.

Correct answer: A

Section 302 of the Sarbanes-Oxley Act requires that periodic financial reports be certified by the CEO and CFO, establishing personal accountability for the accuracy and completeness of financial disclosures. This section mandates that corporate officers personally attest to the accuracy of financial reports and the effectiveness of internal controls. Section 404 addresses internal control assessment, Section 203 addresses auditor independence, and Section 409 addresses real-time disclosure requirements.

Why the other options are wrong:

• B. Section 404 requires management assessment of internal control effectiveness, not CEO/CFO certification of reports.
• C. Section 203 addresses restrictions on auditor non-audit services and auditor rotation, not financial certification.
• D. Section 409 requires real-time disclosure of material changes, not CEO/CFO certification of periodic reports.

Correct answer: C

The primary need for assessing controls is to determine whether the control achieves its intended objective. While alignment with the operating environment, design effectiveness, and operating effectiveness are all important, the fundamental purpose of any control is to achieve a specific objective. Assessment must first establish whether the control successfully accomplishes what it was designed to do.

Why the other options are wrong:

• A. Alignment is important but secondary to whether the control actually achieves its purpose.
• B. Design effectiveness is a component of assessment but not the primary need; a well- designed control that fails in operation does not meet the primary objective.
• D. Operating effectiveness is important but focuses on execution rather than the ultimate goal of objective achievement.

Correct answer: D

Fast tracking involves compressing the project schedule by running tasks in parallel that were originally planned sequentially. This overlap increases risk because there is less time to identify and respond to issues, less buffer for corrections, and increased dependencies between concurrent activities. While costs may increase and resource needs may adjust, the primary and most direct consequence of fast tracking is increased risk exposure.

Why the other options are wrong:

• A. Human resource needs may increase or decrease depending on the specific tasks and how work is redistributed.
• B. Quality control concerns may arise but are not the primary or most likely increase from fast tracking.
• C. Although costs can increase, risk elevation is the most direct and primary consequence of schedule compression.

Correct answer: A

David identified a risk event and took extra steps to ensure the risk event will not happen, costing the project additional money. This describes risk avoidance, where actions are taken to eliminate the risk entirely by modifying project scope, requirements, or approach. The investment of $10,000 to prevent the risk from occurring is characteristic of avoidance strategy.

Why the other options are wrong:

• B. Mitigation reduces the probability or impact of a risk, not eliminate it entirely; avoidance eliminates the risk.
• C. Acceptance acknowledges the risk and prepares contingency plans rather than taking preventive action.
• D. Transfer shifts the risk to another party through insurance or contracts, not through direct preventive actions.

Correct answer: A

The most important objective of information system controls is to ensure that business objectives are achieved while undesired risk events are detected and corrected. This comprehensive statement encompasses both the positive goal of achieving business objectives and the protective goal of identifying and remedying problems. It captures the dual purpose of controls: enabling business success and preventing harm.

Why the other options are wrong:

• B. Ensuring effective and efficient operations is important but is narrower in scope than achieving business objectives and managing risks.
• C. Business continuity and disaster recovery planning are specific control mechanisms, not the primary objective of all controls.
• D. Safeguarding assets is one aspect of control but does not address achieving business objectives comprehensively.

Correct answer: A

The Business Continuity Strategy is prepared by the business organization and serves as the starting point for developing the IT Service Continuity Management (ITSCM) Strategy. The business strategy defines organizational priorities, critical functions, and recovery objectives that IT must support and align with when creating its detailed continuity plans.

Why the other options are wrong:

• B. An Index of Disaster-Relevant Information is a supporting document created during the continuity planning process, not the starting point.
• C. A Disaster Invocation Guideline is an operational document created after the strategy is established, not a foundation document.
• D. Testing schedules are execution documents that come after strategy development, not foundational inputs.

Correct answer: C

Level 5 (Optimized) in risk management capability maturity is characterized by real-time monitoring of risk events and control exceptions, as well as automation of policy management. This highest maturity level represents a fully optimized and continuously improving risk management environment with automated, real-time oversight and management capabilities.

Why the other options are wrong:

• A. Level 3 (Defined) involves documented and communicated processes but not the real-time automation described.
• B. Level 0 (Nonexistent) represents no risk management capability whatsoever.
• D. Level 2 (Repeatable) has basic processes and awareness but lacks the real-time monitoring and automation of Level 5.

Correct answer: A

Cost Performance Index (CPI) is calculated as EV/AC (Earned Value divided by Actual Cost). When CPI > 1, it means earned value exceeds actual cost, indicating the project is spending less than planned for the work completed, which represents better than expected cost performance. This is the correct statement about CPI.

Why the other options are wrong:

• B. CPI is calculated as EV divided by AC, not multiplied; the formula given is incorrect.
• C. CPI measures cost performance, not schedule performance; schedule performance is measured by Schedule Performance Index (SPI).
• D. When CPI = 1, it indicates the project is performing exactly as planned, neither good nor poor; poor performance occurs when CPI < 1.

Correct answer: D

The lack of any significant differences between perpetual inventory levels and actual physical inventory counts is direct evidence-a factual observation of inventory matching. Options A, B, and C all provide indirect information (statements about cutoff procedures, reports showing rejected orders, and reports of unusual deviations are all secondhand information about conditions). Option D represents direct, observable evidence and therefore does NOT provide indirect information.

Why the other options are wrong:

• A. Information about cutoff propriety is indirect evidence derived from documentation and procedures.
• B. Reports showing rejected orders are indirect evidence-they report on conditions rather than directly observing them.
• C. Reports providing information about deviations and margins are indirect evidence derived from analysis and reporting.

Correct answer: A

The salience model is a framework that identifies and categorizes stakeholders based on three key attributes: power (their ability to influence the project), urgency (the degree to which their claims require immediate attention), and legitimacy (whether their involvement in the project is perceived as appropriate or valid). This three-dimensional model helps project managers understand stakeholder importance and determine appropriate engagement strategies.

Why the other options are wrong:

• B. This describes a power/interest grid, which groups stakeholders by authority and concern, not the three dimensions of the salience model.
• C. This describes an influence/impact grid used for stakeholder analysis, focusing on active involvement and ability to affect changes rather than power, urgency, and legitimacy.
• D. This describes a power/influence matrix, which only considers two dimensions (authority and involvement) rather than the three components of the salience model.

Correct answer: A

The first step in the risk assessment process is the identification of assets because you must know what needs to be protected before you can identify threats, threat sources, or vulnerabilities. Assets are the foundation upon which all subsequent risk analysis depends; without knowing what valuable resources exist, any threat or vulnerability assessment would lack context and purpose.

Why the other options are wrong:

• B. While threat identification is important, it comes after understanding what assets exist that could be threatened.
• C. Identifying threat sources requires prior knowledge of what assets could be targeted and what threats exist.
• D. Vulnerability identification follows asset identification because vulnerabilities are weaknesses in specific assets that could be exploited.

Correct answer: A

The risk indicator matrix is used to specify risk thresholds. This matrix establishes the defined levels at which risks are considered acceptable, require monitoring, or demand immediate action. It provides a structured framework for determining when a risk has crossed acceptable tolerance levels and what response is appropriate.

Why the other options are wrong:

• B. An impact matrix measures the potential consequences of risks but does not specify thresholds for acceptance or action.
• C. A risk scenario matrix describes potential risk situations and outcomes but is not the primary tool for specifying risk thresholds.
• D. A probability matrix measures the likelihood of risks occurring but does not establish the thresholds that determine risk acceptability.

Correct answer: B

Risk monitoring and controlling is the project management process responsible for looking for new risks, tracking identified risks, re-analyzing existing risks, monitoring risk responses, and identifying risks that have become outdated. This process ensures that risk management remains active throughout the project lifecycle and that the risk register is continuously updated to reflect the current project environment.

Why the other options are wrong:

• A. Risk planning involves developing the overall risk management strategy and approach but does not involve ongoing surveillance for new or changing risks.
• C. Risk identification is performed during specific phases to identify risks but is not the continuous monitoring process that tracks changes and new risks throughout the project.
• D. Risk analysis evaluates identified risks for probability and impact but does not involve the ongoing surveillance for new, changing, or outdated risks.

Correct answer: B

Single Loss Expectancy (SLE) is calculated using the formula: SLE = Asset Value × Exposure Factor. In this case: SLE = $125,000 × 0.25 = $31,250. The exposure factor of 25% represents the percentage of the asset value that would be lost in a single loss event, resulting in a SLE of $31,250.

Why the other options are wrong:

• A. This result appears to add the exposure factor value rather than multiply it, which is not the correct SLE formula.
• C. This calculation is incorrect and does not reflect the proper application of the SLE formula.
• D. This result incorrectly multiplies the asset value by 25,000 instead of applying the 25% exposure factor correctly.

Correct answer: C

The most important reason to maintain Key Risk Indicators is that threats and vulnerabilities change over time. As the project environment evolves, new threats emerge, existing vulnerabilities may be mitigated, and the risk landscape shifts. Maintaining KRIs ensures they remain relevant and continue to provide accurate, actionable insights into the current state of project risks.

Why the other options are wrong:

• A. While timely risk reports are important, the primary reason to maintain KRIs is to account for changing threat and vulnerability conditions.
• B. Complex metrics requiring fine-tuning is a secondary operational consideration, not the primary driver for maintaining KRIs.
• D. KRIs help detect and manage risk rather than avoid it entirely; they enable proactive monitoring but do not prevent all risks from occurring.

Correct answer: A

Program management control is an administrative control, not a technical control. Technical controls are implemented through technology and systems (such as identification and authentication, access control, and system/communications protection), while program management control deals with policies, procedures, and organizational governance. Administrative controls are distinct from technical controls in security frameworks.

Why the other options are wrong:

• B. System and Communications Protection is a technical control implemented through technology.
• C. Identification and Authentication is a technical control involving systems and mechanisms.
• D. Access Control is a technical control enforced through system mechanisms.

Correct answer: C

Brainstorming is the risk identification method where a facilitator helps generate ideas about project risks from a group of project team members and stakeholders to create a comprehensive list. This is characterized by the use of a facilitator and creative idea generation within a group setting.

Why the other options are wrong:

• A. Delphi Technique uses anonymous rounds of questioning with experts, not facilitated group discussion.
• B. Expert judgment relies on individual experts' knowledge, not group facilitation.
• D. Checklist analysis uses predetermined lists of risks rather than generating ideas through facilitation.

Correct answer: C

A data loss prevention program is an administrative control as it involves policies, procedures, and organizational programs to prevent unauthorized data disclosure. Administrative controls are management-focused and policy-driven rather than technical implementations.

Why the other options are wrong:

• A. Water detection is a physical/environmental control, not administrative.
• B. Reasonableness check is a technical control that validates data accuracy.
• D. Session timeout is a technical control implemented in systems and applications.

Correct answer: D

The Risk Management Plan is the document that defines how risks will be identified, quantified, and how contingency plans will be implemented throughout the project. It establishes the procedures and guidelines for managing project risks.

Why the other options are wrong:

• A. A Project Plan is broader and covers multiple knowledge areas.
• B. Resource Management Plan focuses on managing project resources, not risks.
• C. Project Management Plan is an umbrella document that includes the Risk Management Plan as a component.

Correct answer: D

The Risk Register is the document where all identified risks and their corresponding risk responses are recorded and continuously updated as the project progresses. It serves as the central repository for all risk information throughout the project lifecycle.

Why the other options are wrong:

• A. The Risk Management Plan defines the processes for managing risk, not the live record of risks.
• B. The Project Management Plan is a planning document, not a tracking document for risks.
• C. Risk Response Plan is not a standard PMBOK term; risk responses are documented in the Risk Register.

Correct answer: A

Transference is the risk response strategy where the project manager shifts the risk to another party, such as hiring an external company to handle hardware work and transferring the associated risk to that vendor. This transfers both the risk and responsibility.

Why the other options are wrong:

• B. Mitigation reduces the probability or impact of a risk rather than transferring it.
• C. Avoidance eliminates the activity causing the risk, not hires someone else to do it.
• D. Exploit (or opportunity enhancement) applies to positive risks, not negative risks.

Correct answer: A

Activity duration estimates are useful in identifying risks associated with time allowances and schedule uncertainty. The range in duration estimates indicates the degree of risk and variability in the project schedule, helping identify time-related risks.

Why the other options are wrong:

• B. Activity cost estimates relate to budget risks, not time allowances and schedule variability.
• C. Risk Management Plan is an output planning document, not an input to identify risks.
• D. Schedule Management Plan defines how schedule is managed, but duration estimates are the direct input for identifying time-related risks.

Correct answer: C

Information systems controls should be designed primarily to support the organization's strategic objectives and goals. The organizational strategic plan (Option C) defines what the enterprise aims to achieve, and controls must align with these strategic priorities. While the IT strategic plan, existing IT environment, and IT budget are all relevant considerations, they are secondary to ensuring controls support the overarching organizational strategy.

Why the other options are wrong:

• A. The IT strategic plan is derivative of and should support the organizational strategy, not the primary driver.
• B. The existing IT environment is a constraint to work within, but does not define what controls should accomplish.
• D. Budget is a resource constraint that must work within strategic priorities, not a primary consideration for what controls to design.

Correct answer: C

A blame culture is the single most damaging inhibitor of relevant and efficient risk communication. Where individuals or business units fear being punished for reporting bad news, problems, losses and emerging risks are hidden or downplayed, so management never receives the accurate, timely information needed to make risk decisions. Removing the blame culture is a prerequisite for open, honest upward and cross-organizational risk reporting.

Why the other options are wrong:

• A. A false sense of confidence and unclear tone from the top is a consequence of poor risk information and weak governance rather than the primary barrier that stops people from communicating.
• B. The perception of a cover-up damages stakeholder trust and credibility, but it does not itself prevent information from flowing within the enterprise.
• D. Misalignment between real risk appetite and policies causes inconsistent risk decisions and control gaps, not an inability to communicate risk information.

Correct answer: C

Small risks that have minimal impact should be added to a low-priority risk watch list (Option C). This approach maintains visibility and tracking of these risks without consuming excessive management resources. While they may ultimately be accepted (Option B), they should not be entirely dismissed (Option A), and the proper risk management practice is to document and monitor them rather than ignoring them completely. Option D is overly rigid-not all risks require the same level of formal documented response.

Why the other options are wrong:

• A. Dismissing risks entirely violates risk management best practices and removes any tracking or monitoring capability.
• B. While acceptance may be the eventual outcome, the initial proper step is to add them to a watch list for monitoring.
• D. While documented responses are important for significant risks, prescribing identical documentation levels for all risks regardless of impact is inefficient and impractical.

Correct answer: A

An intrusion detection system (IDS) is a detective control because it identifies and alerts on security policy violations after they occur. Detective controls work by discovering unauthorized activities or policy breaches that have already happened. An IDS monitors traffic and system activity, detects anomalies or known attack patterns, and generates alerts-it does not prevent intrusions (preventative), fix them during occurrence (corrective), or restore systems afterward (recovery).

Why the other options are wrong:

• B. Corrective controls remediate issues after detection, but IDS only identifies them; it does not correct the violation.
• C. Preventative controls stop unauthorized activities before they occur, while IDS allows intrusions to happen and then detects them.
• D. Recovery controls restore systems to normal operation after an incident, which is beyond the detection and alerting function of an IDS.

Correct answer: B

The risk response process is triggered when risk level increases above risk tolerance (Option B). Risk tolerance represents the maximum acceptable level of risk exposure that an organization is willing to endure. When a risk exceeds this threshold, it demands a response action. Risk appetite is the amount of risk the organization is willing to accept in pursuit of its objectives, which is broader and more strategic than the specific trigger point for response actions. Equating either metric (Options C and D) would not trigger response; exceeding the tolerance threshold does.

Why the other options are wrong:

• A. Risk appetite is a strategic preference, not typically the immediate trigger; risk tolerance is the operational threshold that triggers response.
• C. When risk equals appetite, it is at an acceptable level and would not necessarily trigger a response action.
• D. When risk equals tolerance, it has reached the limit but the triggering event is when it exceeds tolerance, not when it equals it.

Correct answer: A

The exposure factor (EF) represents the percentage of an asset's value that would be lost if a specific threat occurs. When an asset is lost completely, 100% of its value is lost, which equals an exposure factor of 1 (representing 1.0 or 100%). This is used in risk calculations: Annual Loss Expectancy (ALE) = Single Loss Expectancy (SLE) × Annual Rate of Occurrence, where SLE = Asset Value × Exposure Factor.

Why the other options are wrong:

• B. Infinity is not a valid exposure factor value; it would make calculations meaningless.
• C. An exposure factor of 10 would represent 1000% loss, which is impossible for a single asset.
• D. An exposure factor of 0 would mean no loss occurs, which contradicts the premise of complete asset loss.

Correct answer: D

When an organization identifies and takes advantage of a positive byproduct or opportunity that arises from a project, this is an example of the 'Exploiting' risk response strategy. Exploiting means actively pursuing and maximizing the benefits of positive risks or opportunities. This is the correct terminology used in standard risk management frameworks for seizing beneficial outcomes that emerge from project activities.

Why the other options are wrong:

• A. Enhancing refers to amplifying positive impacts, but in this context, the organization is capitalizing on an unexpected opportunity rather than deliberately enhancing a known benefit.
• B. Positive is a category descriptor, not the specific response strategy name.
• C. Opportunistic describes the nature of the byproduct but is not the formal risk response strategy terminology.