Section: Volume D
Explanation:
The Management class of controls includes five families. These families include over 40 individual controls.
Following is a list of each of the families in the Management class:
* Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones.
* Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour for users. Rules of Behaviour are also called an acceptable use policy.
* Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability scanning.
* System and Services Acquisition (SA): The SA family includes any controls related to the purchase of products and services. It also includes controls related to software usage and user installed software.
* Program Management (PM): This family is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance with FISMA. These controls complement other controls.
They don't replace them.
Incorrect Answers:
B, D: Identification and authentication, and audit and accountability control are technical class of controls.

is incorrect. This is not a valid statement. The cost management plan is an input to the quantitative risk analysis process. Answer:B is incorrect. The cost management plan defines the estimating, budgeting, and control of the project's cost. Answer:C is incorrect. While the cost management plan does define the cost change control system, this is not the best answer for this

Section: Volume C
Explanation
Explanation:
As new threats are identified and prioritized in terms of impact, the first step is to evaluate the ability of existing controls to mitigate risk associated with new threats and if it does not work then in that case facilitate the:
* Modification of the technical architecture
* Deployment of a threat-specific countermeasure
* Implementation of a compensating mechanism or process until mitigating controls are developed
* Education of staff or business partners
Incorrect Answers:
D: Applying more controls is not the good solution. They usually complicate the condition.

Explanation/Reference:
Explanation:
0 nonexistent: An enterprise's risk management capability maturity level is 0 when:
The enterprise does not recognize the need to consider the risk management or the business impact

from IT risk.
Decisions involving risk lack credible information.

Awareness of external requirements for risk management and integration with enterprise risk

management (ERM) do not exists.
Incorrect Answers:
A, C, D: These all are higher levels of capability maturity model and in this enterprise is mature enough to recognize the importance of risk management.