CRISC Question 125

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose D1

  When using risk scenarios to estimate the likelihood and impact of significant risks on an organization, you are conducting: D. Risk assessment. Risk assessment is a process in which you identify potential threats and vulnerabilities, then analyze the likelihood and impact of these risks on the organization. This process often involves creating hypothetical scenarios to understand how different risks could potentially affect the organization's operations, assets, or objectives. It's a key component of a comprehensive risk management strategy.

• 1

  The correct answer is D. Risk assessment. Risk assessment is the process of identifying, analyzing, and evaluating potential risks to an organization. It involves estimating the likelihood and impact of each risk, and developing mitigation strategies to reduce the likelihood or impact of the risk. IT security assessment, IT audit, and threat and vulnerability assessment are all subprocesses of risk assessment. They are used to gather information about the organization's IT infrastructure, identify potential threats and vulnerabilities, and assess the likelihood and impact of potential risks. Therefore, the assessment you are doing when using risk scenarios for estimating the likelihood and impact of the significant risks on this organization is D. Risk assessment.

• 2

  should be C