Accepting risk is the only risk response strategy that could be applied to both positive and negative risk that has been identified. Accepting risk means taking no action to change the likelihood or impact of the risk, but being prepared to deal with the consequences if the risk occurs. Accepting risk is usually chosen when the risk is low, unavoidable, or outweighed by the benefits. For positive risks, accepting risk means taking advantage of the opportunities if they arise. For negative risks, accepting risk means setting aside contingency reserves or plans to cope with the threats. The other risk response strategies are specific to either positive or negative risks. Transfer, exploit, and mitigate are strategies for negative risks, while share, enhance, and avoid are strategies for positive risks. References = Risk and Information Systems Control Study Manual, Chapter 4, Section 4.3.1, page 4-23.

Explanation/Reference:
Explanation:
Risk threshold helps to identify those risks for which specific responses are needed.

Section: Volume A
Explanation:
Vulnerability is a weakness or lack of safeguard that can be exploited by a threat, thus causing harm to the information systems or networks. It can exist in hardware, operating systems, firmware, applications, and configuration files. Hence lack of adequate controls represents vulnerability and would ultimately cause threat to the enterprise.
Incorrect Answers:
B: Threat is the potential cause of unwanted incident.
C: Assets are economic resources that are tangible or intangible, and is capable of being owned or controlled to produce value.
D: Impact is the measure of the financial loss that the threat event may have.

The percentage of servers receiving automatic patches is the best key control indicator (KCI) to monitor the effectiveness of patch management, because it measures how well the patch management process is ensuring that the servers are updated with the latest security patches and fixes. A high percentage of servers receiving automatic patches indicates that the patch management process is effective and efficient, and that the servers are protected from known vulnerabilities and threats. The other options are not the best KCIs, because they do not directly measure the effectiveness of patch management. The percentage of legacy servers out of support, the number of unpatched vulnerabilities, and the number of intrusion attempts are examples of risk indicators or consequence indicators that measure the exposure or impact of the lack of patch management, but not the performance or outcome of the patch management process. References = ISACA Certified in Risk and Information Systems Control (CRISC) Certification Exam Question and Answers

Section: Volume D