Explanation/Reference:
Explanation:
The purpose of defining a risk response is to ensure that the residual risk is within the limits of the risk appetite and tolerance of the enterprise. Risk response is based on selecting the correct, prioritized response to risk, based on the level of risk, the enterprise's risk tolerance and the cost or benefit of the particular risk response option.
Incorrect Answers:
A: Risk cannot be completely eliminated from the enterprise.
C: This is not a valid answer.
D: Mitigation of risk is itself the risk response process, not the reason behind this.

Section: Volume D
Explanation:
The Management class of controls includes five families. These families include over 40 individual controls.
Following is a list of each of the families in the Management class:
* Certification, Accreditation, and Security Assessment (CA): This family of controls addresses steps to implement a security and assessment program. It includes controls to ensure only authorized systems are allowed on a network. It includes details on important security concepts, such as continuous monitoring and a plan of action and milestones.
* Planning (PL): The PL family focuses on security plans for systems. It also covers Rules of Behaviour for users. Rules of Behaviour are also called an acceptable use policy.
* Risk Assessment (RA): This family of controls provides details on risk assessments and vulnerability scanning.
* System and Services Acquisition (SA): The SA family includes any controls related to the purchase of products and services. It also includes controls related to software usage and user installed software.
* Program Management (PM): This family is driven by the Federal Information Security Management Act (FISMA). It provides controls to ensure compliance with FISMA. These controls complement other controls.
They don't replace them.
Incorrect Answers:
B, D: Identification and authentication, and audit and accountability control are technical class of controls.

is incorrect. The act of spending money to reduce a risk probability and impact is known as mitigation. Answer: D is incorrect. Exploit is a strategy that may be selected for risks with positive impacts where the organization wishes to ensure that the opportunity is realized. Answer: C is incorrect. When extra activities are introduced into the project to avoid the risk, this is an example of avoidance.