CRISC Practice Questions
Quantitative and Qualitative Risk Analysis - 30 Questions
Interactive Quiz
Question 1 of 30
0%
Score: 0
Correct: 0
Wrong: 0
1 What is the PRIMARY difference between quantitative and qualitative risk analysis?
Answer: B - Quantitative uses numerical values; qualitative uses descriptive scales and judgment
Quantitative risk analysis uses numerical, measurable data (e.g., monetary values, probabilities). Qualitative analysis uses descriptive scales (e.g., High/Medium/Low) and expert judgment.
2 What does ALE stand for in quantitative risk analysis?
Answer: A - Annualized Loss Expectancy
ALE (Annualized Loss Expectancy) is the expected monetary loss per year from a specific risk. It is calculated as SLE multiplied by ARO.
3 What does SLE stand for in quantitative risk analysis?
Answer: C - Single Loss Expectancy
SLE (Single Loss Expectancy) is the expected monetary loss from a single occurrence of a risk event. It is calculated as Asset Value (AV) multiplied by Exposure Factor (EF).
4 What does ARO stand for in quantitative risk analysis?
Answer: D - Annualized Rate of Occurrence
ARO (Annualized Rate of Occurrence) is the estimated frequency with which a risk event occurs in a year. For example, if a risk occurs once every 4 years, the ARO is 0.25.
5 How is Annualized Loss Expectancy (ALE) calculated?
Answer: A - ALE = SLE x ARO
ALE is calculated as Single Loss Expectancy (SLE) multiplied by Annualized Rate of Occurrence (ARO). It represents the expected annual monetary loss from a risk.
6 An asset is valued at $500,000. A risk event would destroy 40% of the asset's value. What is the Single Loss Expectancy (SLE)?
Answer: C - $200,000
SLE = AV x EF = $500,000 x 0.40 = $200,000. The Exposure Factor (EF) is the percentage of the asset lost in a single event.
7 An SLE is $100,000 and the ARO is 0.5 (the event occurs once every 2 years). What is the ALE?
Answer: B - $50,000
ALE = SLE x ARO = $100,000 x 0.5 = $50,000. This is the expected annual monetary loss from the risk event.
8 What does the Exposure Factor (EF) represent in quantitative risk analysis?
Answer: D - The percentage of an asset's value lost in a single risk event
The Exposure Factor (EF) is the percentage of an asset's value that would be lost if a specific risk event occurred. It is used to calculate SLE (AV x EF).
9 Which of the following is the PRIMARY advantage of quantitative risk analysis?
Answer: A - It provides objective, measurable, and financially-based results for cost-benefit analysis
The primary advantage of quantitative risk analysis is that it provides objective, measurable, financially-based results. This supports cost-benefit analysis of controls and risk-based decision-making.
10 Which of the following is the PRIMARY advantage of qualitative risk analysis?
Answer: C - It is faster, easier, and requires less data, making it useful when numerical data is unavailable
Qualitative risk analysis is faster, easier to perform, and requires less data. It is useful when numerical data is unavailable or when a quick, high-level risk assessment is needed.
11 Which of the following is a common risk scoring approach used in qualitative risk analysis?
Answer: B - Using a risk matrix with Likelihood and Impact scales
Qualitative risk analysis commonly uses a risk matrix with Likelihood and Impact scales (e.g., High/Medium/Low) to prioritize risks. Monte Carlo and VaR are quantitative techniques.
12 Which of the following is a common technique used in quantitative risk analysis?
Answer: D - Monte Carlo simulation
Monte Carlo simulation is a quantitative technique that models the probability of different outcomes by running many iterations. Delphi, risk matrices, and brainstorming are qualitative techniques.
13 What is Value at Risk (VaR) in quantitative risk analysis?
Answer: A - A statistical measure of the maximum expected loss over a given time period at a certain confidence level
Value at Risk (VaR) is a statistical measure of the maximum expected loss over a specified time period at a given confidence level (e.g., 95% or 99%).
14 Which of the following BEST describes a limitation of qualitative risk analysis?
Answer: C - It is subjective and may lead to inconsistent results between different analysts
Qualitative risk analysis is subjective, which can lead to inconsistent results between different analysts. It lacks the precision of quantitative analysis.
15 Which of the following BEST describes a limitation of quantitative risk analysis?
Answer: B - It requires accurate and sufficient data, which may not always be available, and can be time-consuming and expensive
Quantitative risk analysis requires accurate data, which may not be available. It can be time-consuming and expensive to perform, especially for organizations with limited resources.
16 When is qualitative risk analysis MOST appropriate?
Answer: D - When numerical data is unavailable, when a quick assessment is needed, or for initial risk screening
Qualitative risk analysis is most appropriate when numerical data is unavailable, a quick assessment is needed, or for initial risk screening to prioritize which risks warrant deeper quantitative analysis.
17 When is quantitative risk analysis MOST appropriate?
Answer: A - When significant financial decisions require precise, data-driven justification
Quantitative risk analysis is most appropriate when significant financial decisions require precise, data-driven justification, such as justifying major security investments to the Board.
18 A risk has a High likelihood and a High impact on a qualitative risk matrix. How should this risk be treated?
Answer: C - Treat the risk with priority - implement controls or mitigation immediately
A High/High risk on a qualitative matrix is critical and should be prioritized for immediate mitigation. It typically requires escalation and prompt action.
19 What is the PRIMARY purpose of using a risk matrix in qualitative risk analysis?
Answer: B - To prioritize risks based on their likelihood and impact for management attention
A risk matrix helps prioritize risks based on their likelihood and impact. It provides a visual representation that guides management attention and resource allocation.
20 An organization wants to justify a $50,000 security control. The ALE before the control is $200,000, and the ALE after the control is $30,000. What is the value of the control?
Answer: D - $170,000
The value of the control is the reduction in ALE: $200,000 - $30,000 = $170,000. Since the control costs $50,000 and saves $170,000, it is cost-effective (ROI = $120,000 net benefit).
21 What is the PRIMARY goal of risk analysis (whether quantitative or qualitative)?
Answer: A - To understand and prioritize risks to support informed decision-making
The goal of risk analysis (both quantitative and qualitative) is to understand and prioritize risks so that management can make informed decisions about risk treatment.
22 Which of the following BEST describes "risk analysis" as a process?
Answer: C - A systematic process of understanding the nature of risk and determining its level
Risk analysis is a systematic process of understanding the nature of risk and determining its level. It is an ongoing activity, not a one-time event, and can use both quantitative and qualitative methods.
23 Which of the following is a BEST practice when conducting risk analysis?
Answer: B - Combine qualitative screening with quantitative analysis for high-priority risks
A best practice is to combine qualitative screening (fast, broad coverage) with quantitative analysis for high-priority risks (deep, precise assessment). This balances efficiency with precision.
24 A risk has an SLE of $80,000 and an ARO of 0.25. What is the ALE?
Answer: D - $20,000
ALE = SLE x ARO = $80,000 x 0.25 = $20,000. The risk is expected to cost the organization $20,000 per year on average.
25 Which of the following is a common INPUT to qualitative risk analysis?
Answer: A - Expert judgment and stakeholder workshops
Qualitative risk analysis relies on expert judgment, stakeholder workshops, brainstorming, and Delphi techniques. It does not require precise numerical data.
26 Which of the following is a common INPUT to quantitative risk analysis?
Answer: C - Historical loss data, asset values, and probability estimates
Quantitative risk analysis requires numerical inputs such as historical loss data, asset values, probability estimates, and exposure factors.
27 What is the PRIMARY role of risk analysis in the overall risk management process?
Answer: B - It provides the foundation for risk evaluation and treatment decisions
Risk analysis provides the foundation for risk evaluation (comparing risk against criteria) and risk treatment decisions (what to do about the risk).
28 Which of the following is a KEY benefit of combining quantitative and qualitative risk analysis?
Answer: D - It provides both broad coverage and precise, financially-based justification for high-priority risks
Combining both approaches provides broad coverage (qualitative) and precise, financially-based justification (quantitative) for high-priority risks. This balances efficiency and rigor.
29 What does the term "residual risk" mean in the context of risk analysis?
Answer: A - The risk that remains after controls and mitigation have been applied
Residual risk is the risk that remains after controls and mitigation have been applied. It should be compared against the organization's risk tolerance to determine if further action is needed.
30 Which of the following BEST describes how CRISC views the relationship between quantitative and qualitative risk analysis?
Answer: C - They are complementary techniques, and the choice depends on the context, data availability, and decision-making needs
Quantitative and qualitative risk analysis are complementary. The choice depends on the context, available data, and decision-making needs. Many organizations use both in combination.
🏆
Quiz Complete!
0 / 30
0
Correct
0
Wrong
30
Total
Quick Reference Summary
| Aspect | Quantitative | Qualitative |
|---|---|---|
| Data Type | Numerical, monetary | Descriptive scales (High/Med/Low) |
| Key Techniques | ALE, SLE, ARO, Monte Carlo, VaR | Risk matrix, Delphi, brainstorming |
| Advantage | Objective, precise, cost-benefit ready | Fast, easy, requires less data |
| Limitation | Data-intensive, time-consuming, expensive | Subjective, less precise |
| Best Used For | Major financial decisions, cost-benefit analysis | Initial screening, quick prioritization |
Exam Tips
- Quantitative = Numbers, monetary values, objective. Formula-based (ALE, SLE, ARO).
- Qualitative = Descriptive scales, expert judgment, subjective but fast.
- SLE = AV x EF (Single Loss Expectancy = Asset Value x Exposure Factor).
- ALE = SLE x ARO (Annualized Loss Expectancy = SLE x Annualized Rate of Occurrence).
- ARO = frequency per year (0.5 = once every 2 years).
- Control value = ALE before control - ALE after control. Compare with the cost of the control.
- Use qualitative first for broad screening, then quantitative for high-priority risks.
- Monte Carlo and VaR are quantitative techniques.
- Risk matrix and Delphi are qualitative techniques.
- Residual risk = risk remaining after controls; must be compared to risk tolerance.
0 $type={blogger}:
Post a Comment