説明/参照:
Explanation:
プロジェクト目標に対するマイナスのリスクや脅威に対処するために、回避、転送、軽減、受け入れという 4 つのリスク対応オプションがあります。
リスク回避

リスク軽減

リスク移転

リスク受容

誤った回答:
A、B、C: マイナスのリスクに対処するために利用できるリスク対応は 4 つしかないため、これらは誤った選択です。

セクション: ボリューム D
説明

Performing a threat assessment is the best course of action for a risk practitioner upon learning that regulatory authorities have concerns with an emerging technology that the organization is considering, because it helps to identify and analyze the sources and types of threats that may exploit the vulnerabilities or weaknesses of the technology, and to estimate their likelihood and impact. A threat is a potential event or action that may cause harm or damage to the organization or its objectives, such as a natural disaster, a cyberattack, or a human error. A threat assessment is a process of systematically identifying and assessing the threats that an organization faces, and estimating their probability and severity. An emerging technology is a new or innovative technology that has the potential to disrupt or transform the existing markets, industries, or practices, such as artificial intelligence, blockchain, or biotechnology. An emerging technology may offer benefits such as competitive advantage, efficiency, or creativity, but it may also pose risks such as technical complexity, interoperability issues, regulatory uncertainty, or ethical dilemmas. Therefore, performing a threat assessment is the best course of action, as it helps to understand and evaluate the threats and their consequences, and to determine the appropriate controls or mitigating factors to reduce or eliminate them.
Redesigning key risk indicators (KRIs), updating risk responses, and conducting a SWOT analysis are all possible courses of action to perform after performing a threat assessment, but they are not the best course of action, as they depend on the results and recommendations of the threat assessment. References = Risk and Information Systems Control Study Manual, Chapter 3, Section 3.2.2, page 87

リスク プロファイルは、組織が直面するリスクの性質とレベルの概要です。リスク プロファイルには、リスクの発生源、原因、結果、発生可能性と影響、相互関係と依存関係、リスク選好度とリスク許容度との整合性などの情報が含まれます。リスク プロファイルは、組織の目標、戦略、活動、プロセス、リソース、機能、文化など、さまざまな要因の影響を受けます。新しいサード パーティ アプリケーションの選択プロセス中にリスク プロファイルを定義する場合、含める必要がある最も重要な利害関係者は、ビジネス プロセス所有者です。ビジネス プロセス所有者は、ビジネス プロセスの設計、実行、パフォーマンスの権限と責任を持つ人物です。ビジネス プロセス所有者は、新しいサード パーティ アプリケーションを使用するビジネス プロセスの要件、期待、依存関係、およびアプリケーションの選択によって発生する可能性のある潜在的なリスクと機会について、貴重な情報と洞察を提供できます。ビジネス プロセス所有者は、リスクの優先順位付けと対処を支援し、リスク プロファイルがビジネス目標と戦略と整合していることを確認することもできます。
参照 = 5

The risk register element that is most likely to be updated if the attack surface or exposure of an asset is reduced is the likelihood rating, as this reflects the probability or frequency of a risk event occurring. The attack surface or exposure of an asset is the measure of the extent and accessibility of the asset to potential threats or attackers. If the attack surface or exposure of an asset is reduced, the likelihood of the asset being compromised or damaged by a risk event is also reduced. Therefore, the likelihood rating of the risk should be updated accordingly. The other options are not the risk register elements that are most likely to be updated if the attack surface or exposure of an asset is reduced, although they may be affected or influenced by it.
Control effectiveness is the measure of how well the risk controls reduce the risk level or achieve the control objectives. Assessment approach is the method or technique used to identify, analyze, and evaluate the risks.
Impact rating is the measure of the magnitude or severity of the consequences of a risk event on the asset or the organization. References = Risk and Information Systems Control Study Manual, Chapter 2: IT Risk Identification, page 54.