Section: Volume D

is incorrect. There is no such model exists in risk management process. Answer:B is incorrect. Decision tree analysis is a risk analysis tool that can help the project manager in determining the best risk response. The tool can be used to measure probability, impact, and risk exposure and how the selected risk response can affect the probability and/or impact of the selected risk event. It helps to form a balanced image of the risks andopportunitiesconnected with each possible course of action. This makes them mostly useful for choosing between different strategies, projects, or investment opportunities particularly when the resources are limited. A decision tree is a decision support tool that uses a tree-like graph or model of decisions and their possible consequences, including chance event outcomes, resource costs, and utility. Answer:C is incorrect. Fishbone diagrams or Ishikawa diagrams shows the relationships between the causes and effects of problems.

Explanation/Reference:
Explanation:
Monitoring tools that focuses on transaction data generally correlate information from one system to another, such as employee data from the human resources (HR) system with spending information from the expense system or the payroll system.
Incorrect Answers:
B: Process integrity is confirmed within the system, it does not need monitoring.
C: Configuration settings are generally compared against predefined values and not based on the correlation between multiple sources.
D: System changes are compared from a previous state to the current state, it does not correlate information from multiple sources.

Section: Volume A
Explanation:
Business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others.
Incorrect Answers:
A: Information security managers may best understand the technical tactical situation, but business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others, which includes collaboration with, and support from, lT security managers.
C: The incident response team must ensure open communication to management and stakeholders to ensure that business managers understand the associated risk and are provided enough information to make informed risk-based decisions. They are not responsible for reviewing risk response options.