Reference: https://www.isaca.org/Groups/Professional-English/it-audit-tools-an…

Explanation: Sammy She certainly can create an assessment for a risk event for time cost, and scope. It is probable that a risk event may have an effect on just one or more objectives so an assessment of the objective is acceptable.
Incorrect Answers:
A: Just because Sammy is the project manager, it is not necessary that she is right.
C: Harry is incorrect as there are multiple approaches to risk assessment for a project
D: Harry’s reasoning is flawed as each objective can be reviewed for the risk’s impact rather than the total project.

Explanation: Cause-and-effect analysis involves the use of predictive or diagnostic analytical tool for exploring the root causes or factors that contribute to positive or negative effects or outcomes. These tools also help in identifying potential risk.
Incorrect Answers:
A: This analysis is not a method for exposing risk factors. It is used for analyzing scenarios.
B: Sensitivity analysis is the quantitative risk analysis technique that:

• Assist in determination of risk factors that have the most potential impact
• Examines the extent to which the uncertainty of each element affects the object under consideration when all other uncertain elements are held at their baseline values

C: Fault tree analysis (FIA) is a technique that provides a systematic description of the combination of possible occurrences in a system, which can result in an undesirable outcome. It combines hardware failures and human failures.

Explanation:
In a blame culture, business units tend to point the finger at IT when projects are not delivered on time or do not meet expectations. In doing so, they fail to realize how the business unit’s involvement up front affects project success. In extreme cases, the business unit may assign blame for a failure to meet the expectations that the unit never clearly communicated.
Incorrect Answers: A, B, C: These are not relevant to the pointing of finger at IT when projects are not delivered on time.

Explanation: Approval of a project initiation document (PID) or a project request document (PRD) is the authorization for a project to begin.
Incorrect Answers:
A: Project management plan is being made after the project is being authorized.
B: Risk response document comes under risk management process, hence the latter phase in project development process.
C: Risk management document is being prepared later after the project initiation, during the risk management plan. It has no scope during project initialization.

Explanation:
Availability relates to information being available when required by the business process in present as well as in future. Resilience is the ability to provide and maintain an acceptable level of service during disasters or when facing operational challenges. Hence they are most closely related.
Incorrect Answers:
A: Integrity relates to the accuracy and completeness of information as well as to its validity in accordance with business values and expectations. While the lack of system resilience can in some cases affect data integrity, resilience is more closely linked to the business information requirement of availability.
B: Confidentiality deals with the protection of sensitive information from unauthorized disclosure. While the lack of system resilience can in some cases affect data confidentiality, resilience is more closely linked to the business information requirement of availability.
C: Effectiveness deals with information being relevant and pertinent to the business process as well as being delivered in a timely, correct, consistent and usable manner. While the lack of system resilience can in some cases affect effectiveness, resilience is more closely linked to the business information requirement of availability.

Explanation:
Change requests must be documented to be considered. Alice should create a change request form and follow the procedures of the change control system.

Explanation:
Return On Investment (ROI) is a performance measure used to evaluate the efficiency of an investment or to compare the efficiency of a number of different investments. To calculate ROI, the benefit (return) of an investment is divided by the cost of the investment; the result is expressed as a percentage or a ratio.
The return on investment formula: ROI = (Gain from investment – Cost of investment) / Cost of investment
In the above formula “gains from investment”, refers to the proceeds obtained from selling the investment of interest.
Incorrect Answers: A, B: These options are not related to the measurement of efficiency of an investment.
D: RAID is described as a redundant array of inexpensive disks. It is a technology that allows computer users to achieve high levels of storage reliability from low-cost and less reliable PC-class disk-drive components, via the technique of arranging the devices into arrays for redundancy.

Explanation:
The ALE of this project will be $ 108,000. Single Loss Expectancy is a term related to Quantitative Risk Assessment. It can be defined as the monetary value expected from the occurrence of a risk on an asset. It is mathematically expressed as follows: SLE = Asset value * Exposure factor
Therefore,
SLE = 200,000 * 0.45 = $ 90,000
As the loss is occurring once every month, therefore ARO is 12. Now ALE can be calculated as follows:
ALE = SLE * ARO = 90,000 * 12 = $ 108,000