A.Assess the vulnerability management process

B.Conduct a control self-assessment

C.Reassess the inherent risk of the target

D.Conduct a vulnerability assessment

A.Identifying key risk indicators (KRIs)

B.Evaluating the residual risk level

C.Evaluating the return on investment (ROI)

D.Performing a cost-benefit analysis

A.Risk alarm

B.Observation list

C.Watch-list

D.Risk register

E.Explanation:
Watch-list contains risks with low rating of probability and impact. This list is useful for future monitoring of low risk factors.

F.is incorrect. Risk register is a document that contains the results of the qualitative risk analysis, quantitative risk analysis, and risk response planning. Description, category, cause, probability of occurring, impact on objectives, proposed responses, owner, and the current status
of all identified risks are put in the risk register.

A.Re-certify the application access controls.

B.Remove the developer's access.

C.Review, the results of pre-migration testing.

D.Escalate the issue to the service provider.

A.Align business objectives to the risk profile.

B.Explain risk details to management.

C.Implement an organization-specific risk taxonomy.

D.Assess risk against business objectives