You are the project manager of the GHQ project for your company. You are working you're your project team to prepare for the qualitative risk analysis process.Mary, a project team member, does not understand why you need to complete qualitative risks analysis. You explain to Mary that qualitative risks analysis helps you determine which risks needs additional analysis. There are also some other benefits that qualitative risks analysis can do for the project. Which one of the following is NOT an accomplishment of the qualitative risk analysis process?

Cost of the risk impact if the risk event occurs

Corresponding impact on project objectives

Prioritization of identified risk events based on probability and impact

An Authorizing Official plays the role of an approver. What are the responsibilities of an Authorizing Official?Each correct answer represents a complete solution. Choose all that apply.

Determining the requirement of reauthorization and reauthorizing information systems when required

Reviewing security status reports and critical security documents

Ascertaining the security posture of the organization's information system

Establishing and implementing the organization's continuous monitoring program

Determining the requirement of reauthorization and reauthorizing information systems when required

Reviewing security status reports and critical security documents

Ascertaining the security posture of the organization's information system

Jeff, a key stakeholder in your project, wants to know how the risk exposure for the risk events is calculated during quantitative risk analysis. He is worried about the risk exposure which is too low for the events surrounding his project requirements. How is the risk exposure calculated?

The probability of a risk event times the impact of a risk event determines the true risk exposure.

The probability of a risk event plus the impact of a risk event determines the true risk expo sure.

The risk exposure of a risk event is determined by historical information.

The probability of a risk event times the impact of a risk event determines the true risk exposure.

The probability and impact of a risk event are gauged based on research and in-depth analysis.

What component of the change management system is responsible for evaluating, testing, and documenting changes created to the project scope?

Configuration Management System

Project Management Information System

A project team member has just identified a new project risk. The risk event is determined to have significant impact but a low probability in the project. Should the risk event happen it'll cause the project to be delayed by three weeks, which will cause new risk in the project. What should the project manager do with the risk event?

Add the identified risk to the risk register.

Add the identified risk to a quality control management control chart.

Add the identified risk to the risk register.

Add the identified risk to the issues log.

Add the identified risk to the low-level risk watchlist.

Which of the following governance bodies provides management, operational and technical controls to satisfy security requirements?

Chief Information Security Officer

Information Security Steering Committee

Tom is the project manager for his organization. In his project he has recently finished the risk response planning. He tells his manager that he will now need to update the cost and schedule baselines. Why would the risk response planning cause Tom the need to update the cost and schedule baselines?

New or omitted work as part of a risk response can cause changes to the cost and/or schedule baseline.

Risk responses protect the time and investment of the project.

Baselines should not be updated, but refined through versions.

Risk responses may take time and money to implement.

You are the project manager of the NKQ project for your organization. You have completed the quantitative risk analysis process for this portion of the project.What is the only output of the quantitative risk analysis process?

Probability of reaching project objectives

You work as a project manager for BlueWell Inc. You are currently working with the project stakeholders to identify risks in your project. You understand that the qualitative risk assessment and analysis can reflect the attitude of the project team and other stakeholders to risk. Effective assessment of risk requires management of the risk attitudes of the participants. What should you, the project manager, do with assessment of identified risks in consideration of the attitude and bias of the participants towards the project risk?

Evaluate the bias towards the risk events and correct the assessment accordingly

Document the bias for the risk events and communicate the bias with management

Evaluate and document the bias towards the risk events

Evaluate the bias through SWOT for true analysis of the risk events

Evaluate the bias towards the risk events and correct the assessment accordingly

Courtney is the project manager for her organization. She is working with the project team to complete the qualitative risk analysis for her project. During the analysis Courtney encourages the project team to begin the grouping of identified risks by common causes. What is the primary advantage to group risks by common causes during qualitative risk analysis?

It can lead to developing effective risk responses.

It can lead to the creation of risk categories unique to each project.

It helps the project team realize the areas of the project most laden with risks.

It saves time by collecting the related resources, such as project team members, to analyze the risk events.

You work as a project manager for BlueWell Inc. You are working with Nancy, the COO of your company, on several risks within the project. Nancy understands that through qualitative analysis you have identified 80 risks that have a low probability and low impact as the project is currently planned. Nancy's concern, however, is that the impact and probability of these risk events may change as conditions within the project may change. She would like to know where will you document and record these 80 risks that have low probability and low impact for future reference. What should you tell Nancy?

Risks with low probability and low impact are recorded in a watchlist for future monitoring.

Risk identification is an iterative process so any changes to the low probability and low impact risks will be reassessed throughout the project life cycle.

Risks with low probability and low impact are recorded in a watchlist for future monitoring.

All risks, regardless of their assessed impact and probability, are recorded in the risk log.

All risks are recorded in the risk management plan

You work as a project manager for BlueWell Inc. Management has asked you to work with the key project stakeholder to analyze the risk events you have identified in the project. They would like you to analyze the project risks with a goal of improving the project's performance as a whole. What approach can you use to achieve the goal of improving the project's performance through risk analysis with your project stakeholders?

Focus on the high-priority risks through qualitative risk analysis

Involve subject matter experts in the risk analysis activities

Focus on the high-priority risks through qualitative risk analysis

Use qualitative risk analysis to quickly assess the probability and impact of risk events

Involve the stakeholders for risk identification only in the phases where the project directly affects them

Which of the following is the acronym of RTM?

Requirements Traceability Matrix

Thomas is the project manager of the NHJ Project for his company. He has identified several positive risk events within his project and he thinks these events can save the project time and money. Positive risk events, such as these within the NHJ Project are also known as what?

Ancillary constituent components

Which of the following are the tasks performed by the owner in the information classification schemes? Each correct answer represents a part of the solution.Choose three.

To make original determination to decide what level of classification the information requires, which is based on the business requirements for the safety of the data.

To review the classification assignments from time to time and make alterations as the business requirements alter.

To delegate the responsibility of the data safeguard duties to the custodian.

To make original determination to decide what level of classification the information requires, which is based on the business requirements for the safety of the data.

To perform data restoration from the backups whenever required.

To review the classification assignments from time to time and make alterations as the business requirements alter.

To delegate the responsibility of the data safeguard duties to the custodian.

Mary is the project manager for the BLB project. She has instructed the project team to assemble, to review the risks. She has included the schedule management plan as an input for the quantitative risk analysis process. Why is the schedule management plan needed for quantitative risk analysis?

Mary will utilize the schedule controls and the nature of the schedule for the quantitative analysis of the schedule.

Mary will schedule when the identified risks are likely to happen and affect the project schedule.

Mary will utilize the schedule controls to determine how risks may be allowed to change the project schedule.

Mary will use the schedule management plan to schedule the risk identification meetings throughout the remaining project.

Sammy is the project manager for her organization. She would like to rate each risk based on its probability and affect on time, cost, and scope. Harry, a project team member, has never done this before and thinks Sammy is wrong to attempt this approach. Harry says that an accumulative risk score should be created, not three separate risk scores. Who is correct in this scenario?

Sammy is correct, because organizations can create risk scores for each objective of the project.

Harry is correct, because the risk probability and impact considers all objectives of the project.

Harry is correct, the risk probability and impact matrix is the only approach to risk assessment.

Sammy is correct, because she is the project manager.

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Which of the following are required to be addressed in a well designed policy?Each correct answer represents a part of the solution. Choose all that apply.

Where is the vulnerability, threat, or risk?

Who is expected to comply with the policy?

Who is expected to exploit the vulnerability?

Where is the vulnerability, threat, or risk?

Who is expected to comply with the policy?

Which of the following objectives are defined by integrity in the C.I.A triad of information security systems? Each correct answer represents a part of the solution.Choose three.

It preserves the internal and external consistency of information.

It prevents the unauthorized or unintentional modification of information by the authorized users.

It prevents the modification of information by the unauthorized users.

It preserves the internal and external consistency of information.

It prevents the unauthorized or unintentional modification of information by the authorized users.

It prevents the intentional or unintentional unauthorized disclosure of a message's contents .

It prevents the modification of information by the unauthorized users.

ISC CAP Practice Test 3 - Free Online Exam Prep & Questions

You are the project manager for GHY Project and are working to create a risk response for a negative risk. You and the project team have identified the risk that the project may not complete on time, as required by the management, due to the creation of the user guide for the software you're creating. You have elected to hire an external writer in order to satisfy the requirements and to alleviate the risk event. What type of risk response have you elected to use in this instance?

Sharing

Avoidance

Transference

Exploiting

Comment (0)

ISC CAP Practice Test 3

Question

ISC CAP Practice Tests

Practice Tests