The compensating control that MOST effectively addresses the risk associated with piggybacking into a restricted area without a dead-man door is:

• A.using two-factor authentication
• B.using biometric door locks
• C.requiring employees to wear ID badges
• D.security awareness training

Comment: *

Name: *

Email: *

Verification: *

Which among the following is the MOST crucial part of risk management process?

• A.Risk communication
• B.Auditing
• C.Risk monitoring
• D.Risk mitigation
• E.Explanation:
  Risk communication is a critical part in the risk management process. People are naturally
  uncomfortable talking about risk and tend to put off admitting that risk is involved and
  communicating about issues; incidents; and; eventually, even crises.
  If risk is to be managed and mitigated, it must first be discussed and effectively communicated
  throughout an enterprise.
• F.is incorrect. Risk mitigation is one of the phases of risk management process for
  effective mitigation of risk it should be first communicated throughout an enterprise.
• G.is incorrect. Auditing is done to test the overall risk management process and the
  planned risk responses. So it is the very last phase after completion of risk management process.

Comment: *

Name: *

Email: *

Verification: *

You are the project manager of GHT project. You have selected appropriate Key Risk Indicators for your project. Now, you need to maintain those Key Risk Indicators. What is the MOST important reason to maintain Key Risk Indicators?

• A.Risk reports need to be timely
• B.Complex metrics require fine-tuning
• C.Threats and vulnerabilities change over time
• D.They help to avoid risk

Comment: *

Name: *

Email: *

Verification: *

Which of the following statements are true for risk communication? Each correct answer represents a complete solution. Choose three.

• A.It requires a practical and deliberate scheduling approach to identify stakeholders, actions, and concerns.
• B.It helps in allocating the information concerning risk among the decision-makers.
• C.It requires investigation and interconnectivity of procedural, legal, social, political, and economic factors.
• D.It defines the issue of what a stakeholders does, not just what it says.

Correct Answer: A,C,D

Explanation/Reference:
Explanation:
Risk communication is the process of exchanging information and views about risks among stakeholders, such as groups, individuals, and institutions. Risk communication is mostly concerned with the nature of risk or expressing concerns, views, or reactions to risk managers or institutional bodies for risk management. The key plan to consider and communicate risk is to categorize and impose priorities, and acquire suitable measures to reduce risks. It is important throughout any crisis to put across multifaceted information in a simple and clear manner.
Risk communication helps in switching or allocating the information concerning risk among the decision- maker and the stakeholders.
Risk communication can be explained more clearly with the help of the following definitions:
It defines the issue of what a group does, not just what it says.

It must take into account the valuable element in user's perceptions of risk.

It will be more valuable if it is thought of as conversation, not instruction.

Risk communication is a fundamental and continuing element of the risk analysis exercise, and the involvement of the stakeholder group is from the beginning. It makes the stakeholders conscious of the process at each phase of the risk assessment. It helps to guarantee that the restrictions, outcomes, consequence, logic, and risk assessment are undoubtedly understood by all the stakeholders.
Incorrect Answers:
B: It helps in allocating the information concerning risk not only among the decision-makers but also stakeholders.

Comment: *

Name: *

Email: *

Verification: *

What are the requirements for creating risk scenarios? Each correct answer represents a part of the solution. Choose three.

• A.Determination of cause and effect
• B.Determination of the value of business process at risk
• C.Potential threats and vulnerabilities that could cause loss
• D.Determination of the value of an asset
• E.Explanation:
  Creating a scenario requires determination of the value of an asset or a business process at risk and the potential threats and vulnerabilities that could cause loss. The risk scenario should be
  assessed for relevance and realism, and then entered into the risk register if found to be relevant.
  In practice following steps are involved in risk scenario development:
  First determine manageable set of scenarios, which include:
  Frequently occurring scenarios in the industry or product area.
  Scenarios representing threat sources that are increasing in count or severity level.
  Scenarios involving legal and regulatory requirements applicable to the business.
  After determining manageable risk scenarios, perform a validation against the business objectives
  of the entity.
  Based on this validation, refine the selected scenarios and then detail them to a level in line with
  the criticality of the entity.
  Lower down the number of scenarios to a manageable set. Manageable does not signify a fixed
  number, but should be in line with the overall importance and criticality of the unit.
  Risk factors kept in a register so that they can be reevaluated in the next iteration and included for
  detailed analysis if they have become relevant at that time.
  Risk factors kept in a register so that they can be reevaluated in the next iteration and included for
  detailed analysis if they have become relevant at that time.
  Include an unspecified event in the scenarios, that is, address an incident not covered by other
  scenarios.

Comment: *

Name: *

Email: *

Verification: *