Explanation/Reference:
Explanation:
Once the set of risk scenarios is defined, it can be used for risk analysis. In risk analysis, likelihood and impact of the scenarios are assessed. Important components of this assessment are the risk factors.
Incorrect Answers:
A: Risk mitigation is the latter step after analyzing risk.
B: Risk monitoring is the latter step after risk analysis and risk mitigation.
C: Risk analysis comes under risk management, therefore management is a generalized term, and is not the best answer for this question.

Section: Volume D

is incorrect. Information security managers may best understand the technical tactical situation, but business managers are accountable for managing the associated risk and will determine what actions to take based on the information provided by others, which includes collaboration with, and support from, lT security managers. Answer: C is incorrect. The incident response team must ensure open communication to management and stakeholders to ensure that business managers understand the associatedrisk and are provided enough information to make informed risk-based decisions. They are not responsible for reviewing risk response options.

Section: Volume D
Explanation