Explanation/Reference:
Explanation:
The first step after receiving any change request in a project must be first analyzed for its impact. Changes may be requested by any stakeholder involved with the project. Although, they may be initiated verbally, they should always be recorded in written form and entered into the change management and/or configuration management.
Incorrect Answers:
A, B, D: All these are the required steps depending on the change request. Any change request must be followed by the impact analysis of the change.

Section: Volume D
Explanation:
Risk management provides an approach for individuals and groups to make a decision on how to deal with potentially harmful situations.
Following are the four phases involved in risk management:
1. Risk identification: The first thing we must do in risk management is to identify the areas of the project where the risks can occur.
This is termed as risk identification. Listing all the possible risks is proved to be very productive for the enterprise as we can cure them before it can occur. In risk identification both threats and opportunities are considered, as both carry some level of risk with them.
2. Risk Assessment and Evaluation: Risk assessment use quantitative and qualitative analysis approaches to evaluate each significant risk identified.
3. Risk Prioritization and Response: As many risks are being identified in an enterprise, it is best to give each risk a score based on its likelihood and significance in form of ranking. This concludes whether the risk with high likelihood and high significance must be given greater attention as compared to similar risk with low likelihood and low significance. Hence, risks can be prioritized and appropriate responses to those risks are created.
4. Risk Monitoring: Risk monitoring is an activity which oversees the changes in risk assessment. Over time, the likelihood or significance originally attributed to a risk may change. This is especially true when certain responses, such as mitigation, have been made.

規制の厳しい業界の組織がアプリケーションの機能を包括的にテストするには、非運用環境で匿名データを使用するのが最善のアプローチです。匿名データとは、個人を特定できる情報 (PII) やその他の機密データ (名前、住所、電話番号、電子メール アドレスなど) が削除されたデータです。匿名データは、元のデータの構造と形式を維持しながら、データのプライバシーとセキュリティを保護します。非運用環境で匿名データを使用すると、組織はデータ漏洩や規制違反のリスクを負うことなく、アプリケーションの機能をテストできます。運用環境または非運用環境のいずれにおいても、運用データ、マスクされたデータ、またはテスト データを使用することは、データまたはアプリケーションにエラー、不整合、または脆弱性をもたらす可能性があるため、匿名データを使用するほど最適ではありません。参考文献 = リスクおよび情報システム制御研究マニュアル、第 3 章、セクション 3.3.1、ページ 3-21。

セクション: ボリューム D