Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified in Risk and Information Systems Control · Isaca
Select 2 answers.
This question asks for 2 answers, but our data marks only 1. Compare with the community discussion below for the full answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Option Analysis A. Potential threats and vulnerabilities that could lead to loss events ✅ • Fundamental to a scenario: you need to know what threats exist and which vulnerabilities they can exploit. B. Determination of the value of an asset at risk ❌ • Asset value helps in quantitative risk analysis, but it’s not a primary requirement for developing the scenario itself. C. Determination of actors that has potential to generate risk ✅ • You must know who/what could cause the risk (e.g., malicious insider, hacker, system failure). D. Determination of threat type ❌ • Important, but it’s a classification detail. The broader requirement is already captured in A (threats/vulnerabilities) and C (actors).
Whilst B is Important for quantifying impact, but I do not believe it is a primary requirement for scenario development.
A. Potential threats and vulnerabilities that could lead to loss events C. Determination of actors that has potential to generate risk These are the primary requirements for developing risk scenarios. They focus on identifying potential threats, vulnerabilities, and the actors that might cause risk events. This helps in effectively understanding and assessing the risks to prepare mitigation strategies