Download ISACA.CRISC.PrepDumps.2016-03-05.393q.vcex

Threats and vulnerabilities change over time and KRI maintenance ensures that KRIs continue to effectively capture these changes.The risk environment is highly dynamic as the enterprise's internal and external environments are constantly changing. Therefore, the set of KRIs needs to be changed over time, so that they can capture the changes in threat and vulnerability. Answer: B is incorrect. While most key risk indicator (KRI) metrics need to be optimized in respect to their sensitivity, the most important objective of KRI maintenance is to ensure that KRIs continue to effectively capture the changes in threats and vulnerabilities over time. Hence the most important reason is that because of change of threat and vulnerability overtime.maintenance.reporting, but is not the reason for maintenance of KRIs.

The risk responses that do not exist up till then, should be included in the organization's lessons learned database so other project managers can use these responses in their project if relevant.then it may not be shared with project managers working on some other project.plan during the project and they'll be entered into the organization's lessons learned database.project, they should be entered into the organization's lessons learned database.

Creating a scenario requires determination of the value of an asset or a business process at risk and the potential threats and vulnerabilities that could cause loss. The risk scenario should be assessed for relevance and realism, and then entered into the risk register if found to be relevant.In practice following steps are involved in risk scenario development:First determine manageable set of scenarios, which include:Frequently occurring scenarios in the industry or product area. Scenarios representing threat sources that are increasing in count or severity level. Scenarios involving legal and regulatory requirements applicable to the business. After determining manageable risk scenarios, perform a validation against the business objectives of the entity.Based on this validation, refine the selected scenarios and then detail them to a level in line with the criticality of the entity.Lower down the number of scenarios to a manageable set. Manageable does not signify a fixed number, but should be in line with the overall importance and criticality of the unit. Risk factors kept in a register so that they can be reevaluated in the next iteration and included for detailed analysis if they have become relevant at that time. Risk factors kept in a register so that they can be reevaluated in the next iteration and included for detailed analysis if they have become relevant at that time. Include an unspecified event in the scenarios, that is, address an incident not covered by other scenarios.the root causes or factors that contribute to positive or negative effects or outcomes. It is used during the process of exposing risk factors.

The Communications Management Plan defines, in regard to risk management, who will be available to share information on risks and responses throughout the project. The Communications Management Plan aims to define the communication necessities for the project and how the information will be circulated. The Communications Management Plan sets the communication structure for the project. This structure provides guidance for communication throughout the project's life and is updated as communication needs change. The Communication Managements Plan identifies and defines the roles of persons concerned with the project. It includes a matrix known as the communication matrix to map the communication requirements of the project.monitoring.

Physical security is an example of non-technical control. It comes under the family of operational controls.safeguards that are incorporated into computer hardware, software or firmware, hence they refer to as technical controls.

Decision tree diagrams are used during the Quantitative risk analysis process and not in risk identification.All the these options are diagrammatical techniques used in the Identify risks process.

The utility of the risk describes the usefulness of a particular risk to an individual. Moreover, the same risk can be utilized by two individuals in different ways. Financial outcomes are one of the methods for measuring potential value for taking a risk. For example, if the individual's economic wealth increases, the potential utility of the risk will decrease. Answer: C is incorrect. It is not the valid definition. Answer: A is incorrect. Determining financial incentive is one of the method to measure the potential value for taking a risk, but it is not the valid definition for utility of risk. Answer: B is incorrect. It is not the valid definition.

Monitoring tools have to be able to keep up with the growth of an enterprise and meet anticipated growth in process, complexity or transaction volumes; this is ensured by the scalability criteria of the monitoring tool.technology applications and infrastructure to be effective over time. Answer: B is incorrect. For software to be effective, it must be customizable to the specific needs of an enterprise. Hence customizability ensures that end users can adapt the software. Answer: D is incorrect. The impact on performance has nothing related to the ability of monitoring tool to keep up with the growth of enterprise.

Moderate risks are noticeable failure threatening the success of certain goals. Answer: C is incorrect.Extremely high risk are the risks that has large impact on enterprise and are most likely results in failure with severe consequences. Answer: B is incorrect. High risk is the significant failure impacting in certain goals not being met.

By grouping the risks by categories the project team can develop effective risk responses. Related risk events often have common causal factors that can be addressed with a single risk response.