Section: Volume D

Section: Volume D
Explanation:
An insurance policy can compensate the enterprise up to 100% by transferring the risk to another company.
Hence in this stem risk is being transferred.
Incorrect Answers:
A: Updating the risk registry (with lower values for impact and probability) will not actually change the risk, only management's perception of it.
C: Outsourcing the process containing the risk does not necessarily remove or change the risk. While on other hand, insurance will completely remove the risk.
D: Staff capacity to detect or mitigate the risk may potentially reduce the financial impact, but insurance allows for the risk to be mitigated up to 100%.

Section: Volume D
Explanation:
Conducting a feasibility study begins once initial approval has been given to move forward with a project. It includes an analysis to clearly define the need and to identify alternatives for addressing the need.
Incorrect Answers:
B: Acquiring software involves building new or modifying existing hardware or software after final approval by the stakeholder, which is not a phase in the standard SDLC process. If a decision was reached to acquire rather than develop software, this task should occur after feasibility study and defining requirements.
C: Requirements of the project is being defined after conducting feasibility study.
D: This is latter phase in project development process.

Explanation/Reference:
Explanation:
Malware, short for malicious software, is software designed to disrupt computer operation, gather sensitive information, or gain unauthorized access to computer systems. As malicious code protection lists steps to protect against malware, it preserves the information integrity of the enterprise.
Hence Malicious code protection is System and information integrity control. This family of controls provides information to maintain the integrity of systems and data.
Incorrect Answers:
A: Malicious code protection is not a Configuration management control.
Configuration management control is the family of controls that addresses both configuration management and change management. Change control practices prevent unauthorized changes.
C: Malicious code protection is not a Media protection control.
Media Protection includes removable digital media such as tapes, external hard drives, and USB flash drives. It also includes non-digital media such as paper and film. This family of controls covers the access, marking, storage, transport, and sanitization of media.
D: Malicious code protection is not a Personal security control.
The Personal security control is a family of controls including aspects of personnel security. It includes personnel screening, termination, and transfer.