説明/参照:
Explanation:
セキュリティ ログの監視、プログラム変更の実装後のレビュー、および問題管理は、間接的な情報を提供します。セキュリティ ログの監視は、特に失敗したアクセス試行の原因を分析するために使用される場合、セキュリティ環境内の特定の制御に関する間接的な情報を提供します。
プログラム変更の実装後のレビューは、開発プロセスに対する内部統制の有効性に関する間接的な情報を提供します。
問題管理は、最終的にインシデントの原因であると判断される可能性のある、いくつかの異なる IS プロセスの有効性に関する間接的な情報を提供します。
誤った回答:
D: リカバリ テストは、冗長性またはバックアップ制御が効果的に機能していることを示す直接的な証拠です。間接的な情報は提供されません。

D, and C are incorrect. All these are outputs from the "Plan Risk Management" process, which happens prior to the starting of risk identification.

Section: Volume D
Explanation/Reference:

Explanation/Reference:
Explanation:
A threat is any event which have the potential to cause a loss. In other word, it is any activity that represents a possible danger. The loss or danger is directly related to one of the following:
Loss of confidentiality- Someone sees a password or a company's secret formula, this is referred to as

loss of confidentiality. Loss of integrity- An e-mail message is modified in transit, a virus infects a file, or someone makes unauthorized changes to a Web site is referred to as loss of integrity.
Loss of availability- An e-mail server is down and no one has e-mail access, or a file server is down so

data files aren't available comes under loss of availability.
Threat identification is the process of creating a list of threats. This list attempts to identify all the possible threats to an organization. The list can be extensive.
Threats are often sub-categorized as under:
External or internal- External threats are outside the boundary of the organization. They can also be

thought of as risks that are outside the control of the organization. While internal threats are within the boundary of the organization. They could be related to employees or other personnel who have access to company resources. Internal threats can be related to any hardware or software controlled by the business.
Natural or man-made- Natural threats are often related to weather such as hurricanes, tornadoes, and

ice storms. Natural disasters like earthquakes and tsunamis are also natural threats. A human or man- made threat is any threat which is caused by a person. Any attempt to harm resources is a man-made threat. Fire could be man-made or natural depending on how the fire is started.
Intentional or accidental- An attempt to compromise confidentiality, integrity, or availability is intentional.

While employee mistakes or user errors are accidental threats. A faulty application that corrupts data could also be considered accidental.

Section: Volume D
Explanation:
Risks and the corresponding responses are documented in the risk register for the project. Risk register is a document that contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning. Description, category, cause, probability of occurring, impact on objectives, proposed responses, owner, and the current status of all identified risks are put in the risk register.
Incorrect Answers:
A: The stakeholder management strategy defines how stakeholders and their threats, perceived threats, opinions, and influence over the project objectives will be addressed and managed.
B: The outcome of risk events and the corresponding risk responses may be documented in the project's lessons learned documented, but the best answer is to document the risk responses as part of the risk register.
D: The risk management plan defines how risks will be identified and analyzed, the available responses, and the monitoring and controlling of the risk events. The actual risk responses are included in the risk register.